CVE-2026-116308: PostgreSQL dict_int reads beyond zero-length tokens

Published Nov 12, 2026

Updated

Buffer over-read in PostgreSQL dictint allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL dict_int to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL dict_int to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL dict_int to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL dict_int to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL dict_int to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via MITRE·02:15 PM

Data Sourced

via MITRE·02:15 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A database user can exploit the issue. The provided information does not indicate that unauthenticated users can trigger it.

What does an attacker need to do to trigger the disclosure?

The attacker needs to cause dict_int to process a zero-length token. Successful exploitation can disclose portions of PostgreSQL server memory.

Which PostgreSQL releases need remediation?

PostgreSQL releases before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. Upgrade to the applicable listed release or a later release.