Loading vulnerability…
Integer Underflow in PostgreSQL ECPG Causes Client Denial of Service
CVE-2026-16241 is an integer-underflow vulnerability in PostgreSQL ECPG processing of bytea values. A database server administrator can trigger the flaw by sending an ECPG client a bytea value lacking its mandatory prefix. The resulting underflow causes the client to overwrite a very large memory region with bytes outside the attacker's knowledge or control. This typically terminates the client with SIGSEGV, although rare cases may produce application-specific integrity effects. Affected releases precede PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 in their respective branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation typically crashes the affected ECPG client, temporarily interrupting the application or workflow using it. The extensive memory overwrite may, in rare cases, affect client application integrity rather than immediately terminating the process. The overwritten byte values are outside the attacker's knowledge or control; arbitrary code execution and confidentiality loss are not established.
If you can’t patch tonight, do this now.
No CVE-specific temporary workaround is documented. Until client components are patched, limit ECPG connections to trusted database servers under trusted administration.
Patch, then assume compromise.
Upgrade the affected PostgreSQL ECPG client libraries and associated packages to PostgreSQL 18.6, 17.11, 16.15, 15.19, or 14.24 or later in the corresponding major branch, or install the distribution's equivalent security-fixed packages. Ensure remediation covers the client-side ECPG components rather than only the database server.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.