CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.2 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.8 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.21
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2003?
CVE-2026-2003 is classified with a low to medium severity as it involves disclosure of negligible amounts of memory.
How do I fix CVE-2026-2003?
To mitigate CVE-2026-2003, upgrade to PostgreSQL versions 18.2, 17.8, 16.12, 15.16, or 14.21 or later.
What versions of PostgreSQL are affected by CVE-2026-2003?
CVE-2026-2003 affects PostgreSQL versions prior to 18.2, 17.8, 16.12, 15.16, and 14.21.
What type of vulnerability is CVE-2026-2003?
CVE-2026-2003 involves improper validation that can allow for memory disclosure from the type 'oidvector' in PostgreSQL.
Who can be impacted by CVE-2026-2003?
Database users with access to the affected PostgreSQL versions may be impacted by CVE-2026-2003 due to potential memory disclosures.