CVE-2026-116317 PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code

This vulnerability is rated as an Important severity rather than Critical because exploitation requires an attacker to be authenticated as a database user with rights to execute queries against the PostgreSQL instance. While default Red Hat Enterprise Linux deployments enforce authentication boundaries and utilize local peer authentication or network restrictions, an authenticated user can leverage a malformed tsvector to execute code within the context of the unprivileged postgres system account. The blast radius is limited by process isolation and SELinux confinement, preventing immediate direct administrative host takeover.

Restrict network access to the PostgreSQL service to trusted hosts and revoke execute permissions on the vulnerable ranking functions from untrusted database users:

1. Limit incoming network connections to trusted management hosts using firewalld:

# firewall-cmd --permanent --remove-service=postgresql

# firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_network>

# firewall-cmd --reload

2. Revoke execute permissions on ts_rank_cd functions from the PUBLIC role in affected databases:

REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery) FROM PUBLIC;

REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery, integer) FROM PUBLIC;

REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery) FROM PUBLIC;

REVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery, integer) FROM PUBLIC;

Caveats:

Revoking permissions on ts_rank_cd causes applications utilizing text search ranking via Cover Density to fail with permission denied errors. Applying firewall restrictions blocks external connections not originating from explicitly authorized sources.

Warning:

Reloading firewall configurations via firewall-cmd may interrupt active client network connections. If modifying pg_hba.conf to enforce access restrictions, reloading the database service (systemctl reload postgresql) is required and may temporarily affect client connections.