Critical Vulnerability in PostgreSQL: Arbitrary Code Execution via pgvector
Summary
ALSA-2026:85791: Important: postgresql:16 security update. Affects pg_repack versions < 1.5.1-1.module_el9.6.0+146+c54fdeca. Fixed in 1.5.1-1.module_el9.6.0+146+c54fdeca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system known for its robustness, extensibility, and SQL compliance. It supports various data types and advanced features such as transactions, concurrency, and complex queries. The recent vulnerability affects the pgvector extension, which is used for vector similarity search, allowing for efficient querying of high-dimensional data. This vulnerability can lead to arbitrary code execution during the construction of IVFFlat indexes, posing a significant risk to database integrity and security.
Vulnerability Detail
The vulnerability identified as CVE-2026-103484 allows for arbitrary code execution due to an out-of-bounds write during the IVFFlat index build process in the pgvector extension. This flaw can be exploited by an attacker to execute malicious code within the database environment, potentially leading to unauthorized access, data manipulation, or system compromise. The root cause lies in improper handling of memory during index construction, which can be triggered by specially crafted input.
How To Fix
Minimum fixed version
1.5.1-1.module_el9.6.0+146+c54fdeca
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can disable the pgvector extension until the packages are updated. This can be done by executing the following SQL command in the PostgreSQL environment:
DROP EXTENSION IF EXISTS pgvector CASCADE;
Conclusion
The vulnerability in PostgreSQL's pgvector extension poses a serious threat that can lead to arbitrary code execution. It is essential for users to update their packages to the patched versions to safeguard their databases. Regular monitoring and prompt updates are critical in maintaining database security.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2026-103484 is a security vulnerability in the pgvector extension of PostgreSQL that allows for arbitrary code execution due to an out-of-bounds write during index building.
You can check if your installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring code access.
The risks include unauthorized access to the database, potential data breaches, and the ability for attackers to execute malicious code within the database environment.
It is recommended to regularly check for updates and apply them promptly, especially when security vulnerabilities are disclosed.
If immediate updates are not possible, consider disabling the affected extensions as a temporary workaround to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
