Bug 2515320 (CVE-2026-16241)

Summary: CVE-2026-16241 postgresql: PostgreSQL ECPG: Denial of Service via integer underflow
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: dschmidt, jlanda, kshier, rhel-process-autobot, simaishi, stcannon, teagle, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in PostgreSQL ECPG. A highly privileged database server administrator can trigger an integer underflow by sending a specially crafted `bytea` value to the ECPG client. This vulnerability causes the client to overwrite a large memory region, leading to a temporary denial of service (DoS). In rare cases, this could also result in client-specific data integrity issues.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2527313, 2527314    
Bug Blocks:    

Description OSIDB Bzimport 2026-08-13 13:30:37 UTC 
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix.  The client overwrites a huge memory region with bytes outside attacker knowledge or control.  This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write.  Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.