Vulnerability Description
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | >= 14.0, < 14.24 |
Related Weaknesses (CWE)
References
- https://www.postgresql.org/support/security/CVE-2026-16241/Vendor Advisory
FAQ
What is CVE-2026-16241?
CVE-2026-16241 is a vulnerability with a CVSS score of 3.8 (LOW). Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The ...
How severe is CVE-2026-16241?
CVE-2026-16241 has been rated LOW with a CVSS base score of 3.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-16241?
Check the references section above for vendor advisories and patch information. Affected products include: Postgresql Postgresql.