CVE-2026-96883

Received Received - Intake

Type Confusion in pgcollection Extension

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: AMZN

Description

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-24

Generated

2026-09-25

AI Q&A

2026-09-25

EPSS Evaluated

N/A

NVD

CVE-2026-96883

EUVD

EUVD-2026-86406

Affected Vendors & Products

Vendor	Product	Version / Range
aws	pgcollection	2.0.0
aws	pgcollection	2.1.1
aws	pgcollection	2.1.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-843	The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

Executive Summary

This vulnerability is a type confusion issue in AWS pgcollection versions 2.0.0 through 2.1.1. It allows an authenticated remote user to execute arbitrary code as the postgres operating system user by exploiting crafted SQL statements that rely on mismatched type metadata during collection value retrieval and array conversion functions.

Impact Analysis

An attacker could gain full control over the PostgreSQL server, leading to unauthorized data access, modification, or deletion. This could result in data breaches, system compromise, or further network infiltration depending on the server's role and permissions.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Upgrade pgcollection to version 2.1.2 or later to remediate the type confusion vulnerability.

Hi! I’m here to help you understand CVE-2026-96883. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70