CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution
CVE-2026-96883 is a type confusion vulnerability in the pgcollection extension for PostgreSQL. It arises from incorrect type coercion logic when an authenticated user requests a stored icollection value as a type incompatible with its actual stored type. This flaw can cause the PostgreSQL backend to crash or allow arbitrary code execution. The vulnerability affects pgcollection versions 2.0.0 through 2.1.1. It has been fixed in version 2.1.2. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted as they ship version 1.1.1, which does not contain this issue. No workarounds are available.
AI Analysis
Technical Summary
The vulnerability CVE-2026-96883 in pgcollection, an open source PostgreSQL extension, is due to a type confusion error in its type coercion logic. When an authenticated database user requests a stored icollection value as a type incompatible with its actual stored representation, the extension misinterprets the datum's representation. This can lead to a crash of the PostgreSQL backend or remote code execution. The affected versions are pgcollection v2.0.0 through v2.1.1. The issue is resolved in pgcollection v2.1.2. Amazon-managed PostgreSQL services are unaffected because they use version 1.1.1. Users who compiled and deployed affected versions themselves should upgrade to 2.1.2 or later. No workarounds exist.
Potential Impact
An authenticated database user can exploit this vulnerability to cause a denial of service by crashing the PostgreSQL backend or potentially execute arbitrary code remotely. This elevates the risk of unauthorized code execution within the database environment, impacting confidentiality, integrity, and availability of the database system.
Mitigation Recommendations
A fix is available in pgcollection version 2.1.2. Users who have deployed pgcollection versions 2.0.0 through 2.1.1 should upgrade to version 2.1.2 or later. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers are not impacted and require no action. No workarounds are available.
CVE-2026-96883 - Type confusion in AWS pgcollection allows remote code execution
Description
CVE-2026-96883 is a type confusion vulnerability in the pgcollection extension for PostgreSQL. It arises from incorrect type coercion logic when an authenticated user requests a stored icollection value as a type incompatible with its actual stored type. This flaw can cause the PostgreSQL backend to crash or allow arbitrary code execution. The vulnerability affects pgcollection versions 2.0.0 through 2.1.1. It has been fixed in version 2.1.2. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted as they ship version 1.1.1, which does not contain this issue. No workarounds are available.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-96883 in pgcollection, an open source PostgreSQL extension, is due to a type confusion error in its type coercion logic. When an authenticated database user requests a stored icollection value as a type incompatible with its actual stored representation, the extension misinterprets the datum's representation. This can lead to a crash of the PostgreSQL backend or remote code execution. The affected versions are pgcollection v2.0.0 through v2.1.1. The issue is resolved in pgcollection v2.1.2. Amazon-managed PostgreSQL services are unaffected because they use version 1.1.1. Users who compiled and deployed affected versions themselves should upgrade to 2.1.2 or later. No workarounds exist.
Potential Impact
An authenticated database user can exploit this vulnerability to cause a denial of service by crashing the PostgreSQL backend or potentially execute arbitrary code remotely. This elevates the risk of unauthorized code execution within the database environment, impacting confidentiality, integrity, and availability of the database system.
Mitigation Recommendations
A fix is available in pgcollection version 2.1.2. Users who have deployed pgcollection versions 2.0.0 through 2.1.1 should upgrade to version 2.1.2 or later. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL customers are not impacted and require no action. No workarounds are available.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-118-aws/","fetched":true,"fetchedAt":"2026-09-24T19:30:47.777Z","wordCount":174}
Threat ID: 6ab57a67f7a7c54106bea486
Added to database: 09/24/2026, 19:30:47 UTC
Last enriched: 09/24/2026, 19:30:52 UTC
Last updated: 09/25/2026, 02:26:45 UTC
Views: 9
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.