CVE-2026-116315 PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code

Red Hat has rated this vulnerability as having an Important severity because an authenticated user can trigger a heap buffer overflow to execute arbitrary code with the permissions of the postgres service account, potentially compromising the host. While the impact on system integrity, confidentiality, and availability is high, exploitation requires valid database credentials and access to execute SQL functions, which prevents unauthenticated remote execution. In standard Red Hat Enterprise Linux deployments, exposure is further constrained by default SELinux policies that confine the PostgreSQL daemon and restrict access to broader system resources.

Restrict network access to PostgreSQL to trusted hosts and clients only, limiting exposure to untrusted database users.

1. Restrict external network reachability to the PostgreSQL service using firewalld:

# firewall-cmd --permanent --remove-service=postgresql

# firewall-cmd --permanent --zone=trusted --add-source=<TRUSTED_IP_OR_SUBNET>

# firewall-cmd --reload

2. Configure /var/lib/pgsql/data/pg_hba.conf to only permit connections from authorized client addresses and trusted database roles, then reload the configuration:

# systemctl reload postgresql

Warning: Reloading firewall rules or the PostgreSQL service may temporarily interrupt active network connections. These operational controls reduce exposure by limiting network access to trusted clients, but they do not eliminate risk from authenticated users permitted to execute SQL queries.