AZL-113771: CVE-2026-120149 affecting package postgresql 16.15-1
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgresfdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using postgres_fdw to perform foreign batch inserts are exposed when the remote foreign server reports that it inserted more rows than the local server supplied. PostgreSQL 16.15-1 is affected; upstream fixes are available in PostgreSQL 16.16 and later, as well as 18.7, 17.12, 15.20, and 14.25.
What does an attacker need to exploit the vulnerability?
A foreign server must be able to provide an inflated inserted-row count during a foreign batch insert. The advisory states that this can occur legitimately if a rule on the remote table expands an INSERT into additional rows.
What is the impact of successful exploitation?
The heap-based buffer overflow can allow the foreign server to execute arbitrary code.