Threats affecting pkg:github/pgcollection

CVE-2026-96883 is a type confusion vulnerability in the pgcollection extension for PostgreSQL. It arises from incorrect type coercion logic when an authenticated user requests a stored icollection value as a type incompatible with its actual stored type. This flaw can cause the PostgreSQL backend to crash or allow arbitrary code execution. The vulnerability affects pgcollection versions 2.0.0 through 2.1.1. It has been fixed in version 2.1.2. Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted as they ship version 1.1.1, which does not contain this issue. No workarounds are available.