Skip to content

Commit 3f98b70

Browse files
gvasquezvargasgvasquezvargas
authored
Merge pull request #809 from EnterpriseDB/cve-2026-3172
CVE-2026-3172 assessment
2 parents 6ed285c + 8b9a839 commit 3f98b70

File tree

3 files changed

+117
-16
lines changed

3 files changed

+117
-16
lines changed

‎advocacy_docs/security/assessments/cve-2026-3172.mdx‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: CVE-2026-3172 - pgvector buffer overflow in parallel HNSW index build
3+
navTitle: CVE-2026-3172
4+
affectedProducts: EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu
5+
---
6+
7+
First Published: 2026/03/10
8+
9+
Important: This assessment evaluates the impact of CVE-2026-3172 on EDB products and services. It links to and details the CVE and supplements that information with EDB's own assessment.
10+
11+
## Summary
12+
13+
A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the `pgvector` extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun.
14+
This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
15+
16+
## Vulnerability details
17+
18+
CVE-ID: [CVE-2026-3172](https://nvd.nist.gov/vuln/detail/CVE-2026-3172)
19+
20+
CVE Publish Date: 2026-02-25
21+
22+
CVSS Base Score: 8.1
23+
24+
CVSS Temporal Score: Undefined
25+
26+
CVSS Environmental Score: Undefined
27+
28+
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
29+
30+
## Affected products and versions
31+
32+
### EDB Cloud and Managed Services
33+
* EDB Postgres Extended Server
34+
* EDB Postgres Advanced Server
35+
* EDB Cloud Service (formerly BigAnimal)
36+
* Hybrid Manager (HM)
37+
* EDB Postgres® AI for CloudNativePG™ (All community and EDB Postgres® AI for CloudNativePG™ versions)
38+
* WarehousePG
39+
40+
### Affected Extensions
41+
* pgvector: All versions from 0.6.0 through 0.8.1
42+
* aidb
43+
* pgpu
44+
45+
## Remediation/fixes
46+
47+
Remediation for this CVE requires updating the extension version within the database. Updating the underlying EDB product version alone may not apply the fix to existing databases.
48+
49+
### pgvector Extension
50+
51+
| Affected Version | Fixed In | Fix Published |
52+
|------------------|----------|---------------|
53+
| 0.6.0 to 0.8.1 | 0.8.2 | 2026-02-25 |
54+
55+
### aidb Extension
56+
57+
| Affected Version | Fixed In | Fix Published |
58+
|-----------------------|-------------------------------|---------------|
59+
| All prior to Feb 2026 | Updated with 0.8.2 dependency | 2026-02-25 |
60+
61+
### pgpu Extension
62+
63+
| Affected Version | Fixed In | Fix Published |
64+
|-----------------------|-------------------------------|---------------|
65+
| All prior to Feb 2026 | Updated with 0.8.2 dependency | 2026-02-25 |
66+
67+
## References
68+
69+
* [CVSS Calculator v3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
70+
* [NVD - CVE-2026-3172 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-3172)
71+
* [GitHub Advisory GHSA-789c-mgqf-5hwx](https://github.com/advisories/GHSA-789c-mgqf-5hwx)
72+
73+
## Related information
74+
75+
* [EnterpriseDB](https://www.enterprisedb.com/)
76+
* [EDB Docs - pgvector Extension](https://www.enterprisedb.com/docs/pg_extensions/pgvector/)

‎advocacy_docs/security/assessments/index.mdx‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ iconName: Security
66
hideKBLink: true
77
hideToC: false
88
navigation:
9+
- cve-2026-3172
910
- cve-2026-2007
1011
- cve-2026-2006
1112
- cve-2026-2005
@@ -39,6 +40,28 @@ The CVEs listed in this section are from PostgreSQL and other parties who have r
3940
<table class="table-bordered">
4041

4142

43+
<tr><td>
44+
<details><summary><h3 style="display:inline"> CVE-2026-3172 </h3>
45+
<span>
46+
&nbsp;&nbsp;<a href="cve-2026-3172">Read Assessment</a>
47+
&nbsp;&nbsp;Published: </span><span>2026/03/10</span>
48+
<h4>pgvector buffer overflow in parallel HNSW index build</h4>
49+
<h5> EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu</h5>
50+
</summary>
51+
<hr/>
52+
<em>Summary:</em>&nbsp;
53+
A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the <code>pgvector</code> extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun.
54+
This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
55+
<br/>
56+
<a href="cve-2026-3172">Read More...</a>
57+
</details></td></tr>
58+
59+
60+
61+
62+
63+
64+
4265
<tr><td>
4366
<details><summary><h3 style="display:inline"> CVE-2026-2007 </h3>
4467
<span>

‎advocacy_docs/security/index.mdx‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,24 @@ An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 1
118118
<table class="table-bordered">
119119

120120

121+
<tr><td>
122+
<details><summary><h3 style="display:inline"> CVE-2026-3172 </h3>
123+
<span>
124+
&nbsp;&nbsp;<a href="assessments/cve-2026-3172">Read Assessment</a>
125+
&nbsp;&nbsp;Published: </span><span>2026/03/10</span>
126+
127+
<h4>pgvector buffer overflow in parallel HNSW index build</h4>
128+
<h5> EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu</h5>
129+
</summary>
130+
<hr/>
131+
<em>Summary:</em>&nbsp;
132+
A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the <code>pgvector</code> extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun.
133+
This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
134+
<br/>
135+
<a href="assessments/cve-2026-3172">Read More...</a>
136+
</details></td></tr>
137+
138+
121139
<tr><td>
122140
<details><summary><h3 style="display:inline"> CVE-2026-2007 </h3>
123141
<span>
@@ -185,20 +203,4 @@ Improper validation of input types in the PostgreSQL intarray extension allows a
185203
<a href="assessments/cve-2026-2004">Read More...</a>
186204
</details></td></tr>
187205

188-
189-
<tr><td>
190-
<details><summary><h3 style="display:inline"> CVE-2025-8715 </h3>
191-
<span>
192-
&nbsp;&nbsp;<a href="assessments/cve-2025-8715">Read Assessment</a>
193-
&nbsp;&nbsp;Updated: </span><span>2025/08/14</span>
194-
<h4>PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server</h4>
195-
<h5> All versions of Postgresql prior to 17.6, 16.10, 15.14, 14.19, 13.22 3.x, EDB Postgres Extended Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22, EDB Postgres Advanced Server prior to 17.6.0, 16.10.0, 15.14.0, 14.19.0, 13.22</h5>
196-
</summary>
197-
<hr/>
198-
<em>Summary:</em>&nbsp;
199-
Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks can achieve SQL injection as a superuser of the restore target server. pg_dumpall, pg_restore, and pg_upgrade are also affected.
200-
<br/>
201-
<a href="assessments/cve-2025-8715">Read More...</a>
202-
</details></td></tr>
203-
204206
</table>

0 commit comments

Comments
 (0)