CVE-2026-120152: PostgreSQL pg_show_all_settings() use-after-free discloses memory
Use after free in PostgreSQL pgshowallsettings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL major versions 16, 17, and 18 are affected when running versions earlier than 16.16, 17.12, or 18.7, respectively. Versions before PostgreSQL 16 are unaffected.
What level of access does an attacker need?
An attacker must be a database user and must be able to load a module while pg_show_all_settings() is scanning custom-variable placeholders. The issue can disclose memory contents and does not require user interaction.
What should be done to remediate the issue?
Upgrade to PostgreSQL 16.16, 17.12, or 18.7, as appropriate for the deployed major version.