Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via… (CVE-2026-16241)
An integer underflow vulnerability in PostgreSQL's ECPG client allows a database server administrator to cause a temporary denial of service by sending a malformed bytea value missing its mandatory prefix. This leads to the client overwriting a large memory region, typically resulting in a segmentation fault. Rarely, this may cause client-specific integrity issues. The vulnerability affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24.
AI Analysis
Technical Summary
CVE-2026-16241 is an integer underflow vulnerability in the PostgreSQL ECPG client. A malicious database server administrator can exploit this by sending a bytea value without the required prefix, causing the client to overwrite a large memory area with uncontrolled data. This usually triggers a SIGSEGV (segmentation fault), causing a temporary denial of service against the ECPG client. In rare cases, the memory corruption might lead to client-specific integrity impacts. The affected versions are all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24.
Potential Impact
The primary impact is a temporary denial of service against the ECPG client due to memory corruption causing a segmentation fault. There is no confidentiality impact, but there is a low integrity impact possibility in rare cases. The vulnerability requires high privileges (database server administrator) and network access to the server. No known exploits are reported in the wild.
Mitigation Recommendations
Patch to PostgreSQL versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later, where this vulnerability is fixed. Since no official patch links are provided here, users should consult the PostgreSQL official advisories for the corresponding fixed versions. Until patched, restrict database server administrator privileges and avoid using ECPG clients with untrusted servers.
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via… (CVE-2026-16241)
Description
An integer underflow vulnerability in PostgreSQL's ECPG client allows a database server administrator to cause a temporary denial of service by sending a malformed bytea value missing its mandatory prefix. This leads to the client overwriting a large memory region, typically resulting in a segmentation fault. Rarely, this may cause client-specific integrity issues. The vulnerability affects PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24.
CVSS v3.1
Score 3.8low
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16241 is an integer underflow vulnerability in the PostgreSQL ECPG client. A malicious database server administrator can exploit this by sending a bytea value without the required prefix, causing the client to overwrite a large memory area with uncontrolled data. This usually triggers a SIGSEGV (segmentation fault), causing a temporary denial of service against the ECPG client. In rare cases, the memory corruption might lead to client-specific integrity impacts. The affected versions are all PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24.
Potential Impact
The primary impact is a temporary denial of service against the ECPG client due to memory corruption causing a segmentation fault. There is no confidentiality impact, but there is a low integrity impact possibility in rare cases. The vulnerability requires high privileges (database server administrator) and network access to the server. No known exploits are reported in the wild.
Mitigation Recommendations
Patch to PostgreSQL versions 18.5, 17.11, 16.15, 15.19, or 14.24 or later, where this vulnerability is fixed. Since no official patch links are provided here, users should consult the PostgreSQL official advisories for the corresponding fixed versions. Until patched, restrict database server administrator privileges and avoid using ECPG clients with untrusted servers.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-v76f-gmv6-95jw
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-16241"]
- Ecosystems
- []
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a7e0366bf8831d5398f854f
Added to database: 08/13/2026, 17:48:22 UTC
Last enriched: 08/13/2026, 18:01:37 UTC
Last updated: 08/13/2026, 22:40:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.