CVE-2026-16241

3.8 Faible

Publiée le 13/08/2026 à 15:17 · Modifiée le 30/08/2026 à 01:17 · Modifiée · Source : f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Description

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Traduire en français

Produits concernés

PostgreSQL
Postgresql postgresql

Scores CVSS

Version	Score	Source	Vecteur
3.1	3.8 Faible	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L`

Faiblesses (CWE)

CWE-191

Références

https://www.postgresql.org/support/security/CVE-2026-16241/ Vendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories