CVE-2026-16241
Modified
Modified - Updated After Analysis
Integer Underflow in PostgreSQL ECPG Leads to DoS
Vulnerability report for CVE-2026-16241, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-08-13
Last updated on: 2026-08-29
Assigner: PostgreSQL
Description
Description
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| postgresql | postgresql | From 14.0 (inc) to 14.24 (exc) |
| postgresql | postgresql | From 15.0 (inc) to 15.19 (exc) |
| postgresql | postgresql | From 16.0 (inc) to 16.15 (exc) |
| postgresql | postgresql | From 17.0 (inc) to 17.11 (exc) |
| postgresql | postgresql | From 18.0 (inc) to 18.5 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-191 | The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. |
