synced 6 MIN AGO
01 Record

CVE-2026-2003

PostgreSQL oidvector discloses a few bytes of memory

MediumPUBLISHEDCNA: PostgreSQL
CNA base score4.3 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
View raw JSON

02 Description

PostgreSQL oidvector discloses a few bytes of memory

03 Exploitation and scoring

Exploitation
Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.
SSVC decision
  • ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
  • AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
  • Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.
CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.
EPSS probability
0.31% probability of exploitation activity in the next 30 days.
EPSS percentile
Equal to or higher than the score of 24.6% of scored records. A rank, not a probability.
NVD base score
4.3 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
NVD analysis status
Analyzed. NVD last modified this record on 2026-06-17.
Red Hat severity
Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published
2026-02-12 13:00Z8 MO AGO
Last updated
2026-02-12 14:33Z8 MO AGO
Reserved
2026-02-05
Assigning CNA
PostgreSQL
Record state
PUBLISHED
Severity
Medium (CVSS 4.3)
CNA CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
  • CWE-1287Improper Validation of Specified Type of InputBase
Data version
5.2
Document digest
5b13e4fcc2a19cee0840e57e2782b9b3f3e38bacf2959807b072ff395d5dc706

05 Affected products

VendorProductVersionsPlatforms
n/aPostgreSQL18 to < 18.2, 17 to < 17.8, 16 to < 16.12, 15 to < 15.16, 0 to < 14.21—

06 References

07 Fixed in

AlmaLinux 9

  • pg_repack
    Fixed in 1.5.1-1.module_el9.6.0+146+c54fdeca
  • pgaudit
    Fixed in 16.0-1.module_el9.4.0+66+eb9878bc
  • pgvector
    Fixed in 0.6.2-2.module_el9.6.0+167+4e561146
  • postgis
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-client
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-docs
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-upgrade
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-utils
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgres-decoderbufs
    Fixed in 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
  • postgresql
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-contrib
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-docs
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-plperl
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-plpython3
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-pltcl
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-private-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-private-libs
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-server
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-server-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-static
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-test
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-test-rpm-macros
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-upgrade
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-upgrade-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

AlmaLinux 10

  • postgresql
    Fixed in 16.13-1.el10_2
  • postgresql-contrib
    Fixed in 16.13-1.el10_2
  • postgresql-docs
    Fixed in 16.13-1.el10_2
  • postgresql-plperl
    Fixed in 16.13-1.el10_2
  • postgresql-plpython3
    Fixed in 16.13-1.el10_2
  • postgresql-pltcl
    Fixed in 16.13-1.el10_2
  • postgresql-private-devel
    Fixed in 16.13-1.el10_2
  • postgresql-private-libs
    Fixed in 16.13-1.el10_2
  • postgresql-server
    Fixed in 16.13-1.el10_2
  • postgresql-server-devel
    Fixed in 16.13-1.el10_2
  • postgresql-static
    Fixed in 16.13-1.el10_2
  • postgresql-test
    Fixed in 16.13-1.el10_2
  • postgresql-test-rpm-macros
    Fixed in 16.13-1.el10_2
  • postgresql-upgrade
    Fixed in 16.13-1.el10_2
  • postgresql-upgrade-devel
    Fixed in 16.13-1.el10_2
  • postgresql18
    Fixed in 18.3-1.el10_2
  • postgresql18-contrib
    Fixed in 18.3-1.el10_2
  • postgresql18-docs
    Fixed in 18.3-1.el10_2
  • postgresql18-plperl
    Fixed in 18.3-1.el10_2
  • postgresql18-plpython3
    Fixed in 18.3-1.el10_2
  • postgresql18-private-devel
    Fixed in 18.3-1.el10_2
  • postgresql18-private-libs
    Fixed in 18.3-1.el10_2
  • postgresql18-server
    Fixed in 18.3-1.el10_2
  • postgresql18-server-devel
    Fixed in 18.3-1.el10_2
  • postgresql18-static
    Fixed in 18.3-1.el10_2
  • postgresql18-test
    Fixed in 18.3-1.el10_2
  • postgresql18-test-rpm-macros
    Fixed in 18.3-1.el10_2
  • postgresql18-upgrade
    Fixed in 18.3-1.el10_2
  • postgresql18-upgrade-devel
    Fixed in 18.3-1.el10_2

Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 9

  • pg_repack
    Fixed in 1.5.1-1.module_el9.6.0+146+c54fdeca
  • pgaudit
    Fixed in 16.0-1.module_el9.4.0+66+eb9878bc
  • pgvector
    Fixed in 0.6.2-2.module_el9.6.0+167+4e561146
  • postgis
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-client
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-docs
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-upgrade
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgis-utils
    Fixed in 3.5.3-3.module_el9.7.0+187+2286ff0a
  • postgres-decoderbufs
    Fixed in 2.4.0-1.Final.module_el9.4.0+66+eb9878bc
  • postgresql
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-contrib
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-docs
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-plperl
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-plpython3
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-pltcl
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-private-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-private-libs
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-server
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-server-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-static
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-test
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-test-rpm-macros
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-upgrade
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69
  • postgresql-upgrade-devel
    Fixed in 16.13-1.module_el9.7.0+213+65e1da69

Derived from AlmaLinux 9. Partial coverage: only packages taken from AlmaLinux 9 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

CloudLinux 10

  • postgresql
    Fixed in 16.13-1.el10_2
  • postgresql-contrib
    Fixed in 16.13-1.el10_2
  • postgresql-docs
    Fixed in 16.13-1.el10_2
  • postgresql-plperl
    Fixed in 16.13-1.el10_2
  • postgresql-plpython3
    Fixed in 16.13-1.el10_2
  • postgresql-pltcl
    Fixed in 16.13-1.el10_2
  • postgresql-private-devel
    Fixed in 16.13-1.el10_2
  • postgresql-private-libs
    Fixed in 16.13-1.el10_2
  • postgresql-server
    Fixed in 16.13-1.el10_2
  • postgresql-server-devel
    Fixed in 16.13-1.el10_2
  • postgresql-static
    Fixed in 16.13-1.el10_2
  • postgresql-test
    Fixed in 16.13-1.el10_2
  • postgresql-test-rpm-macros
    Fixed in 16.13-1.el10_2
  • postgresql-upgrade
    Fixed in 16.13-1.el10_2
  • postgresql-upgrade-devel
    Fixed in 16.13-1.el10_2
  • postgresql18
    Fixed in 18.3-1.el10_2
  • postgresql18-contrib
    Fixed in 18.3-1.el10_2
  • postgresql18-docs
    Fixed in 18.3-1.el10_2
  • postgresql18-plperl
    Fixed in 18.3-1.el10_2
  • postgresql18-plpython3
    Fixed in 18.3-1.el10_2
  • postgresql18-private-devel
    Fixed in 18.3-1.el10_2
  • postgresql18-private-libs
    Fixed in 18.3-1.el10_2
  • postgresql18-server
    Fixed in 18.3-1.el10_2
  • postgresql18-server-devel
    Fixed in 18.3-1.el10_2
  • postgresql18-static
    Fixed in 18.3-1.el10_2
  • postgresql18-test
    Fixed in 18.3-1.el10_2
  • postgresql18-test-rpm-macros
    Fixed in 18.3-1.el10_2
  • postgresql18-upgrade
    Fixed in 18.3-1.el10_2
  • postgresql18-upgrade-devel
    Fixed in 18.3-1.el10_2

Derived from AlmaLinux 10. Partial coverage: only packages taken from AlmaLinux 10 are listed.

Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.

Debian 12

  • postgresql-15
    Fixed in 15.16-0+deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

  • postgresql-17
    Fixed in 17.8-0+deb13u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

  • postgresql-18
    Fixed in 18.2-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 20.04 LTS

  • postgresql-12
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 22.04 LTS

  • postgresql-14
    Fixed in 14.22-0ubuntu0.22.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 24.04 LTS

  • postgresql-16
    Fixed in 16.13-0ubuntu0.24.04.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu 25.10

  • postgresql-17
    Fixed in 17.9-0ubuntu0.25.10.1

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 14.04 LTS

  • postgresql-9.3
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 16.04 LTS

  • postgresql-9.5
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

Ubuntu Pro 18.04 LTS

  • postgresql-10
    No fix yet

Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.

A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.