AZL-113720: CVE-2026-116321 affecting package postgresql 16.15-1
Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be a database user. The flaw is triggered by assigning an array element containing a fixed-length name value whose final byte has been changed to a nonzero value, then passing that value to code that handles it as a C string.
Is postgresql 16.15-1 affected?
Yes. PostgreSQL versions before 16.16 are affected, so version 16.15-1 falls within the affected range.
What upgrade version resolves the issue for PostgreSQL 16?
Upgrade to PostgreSQL 16.16 or later. Fixed releases are also identified as 18.7, 17.12, 15.20, and 14.25 for their respective major versions.