CVE-2026-116328 PostgreSQL generation memory context integer wraparound executes arbitrary code

Red Hat rates this vulnerability as Important rather than Critical because exploitation requires existing database user credentials, yet enables arbitrary code execution within the operating system context of the PostgreSQL daemon. By default on Red Hat Enterprise Linux, PostgreSQL is configured to accept only local connections, limiting exposure unless remote network access has been specifically granted. Any authenticated user capable of executing resource-intensive queries that trigger large memory allocations can induce this memory corruption, though releases prior to PostgreSQL 16 remain unaffected.

Limit network access to the PostgreSQL service to trusted hosts or localhost to restrict exposure to untrusted networks.

1. Restrict PostgreSQL network access using firewalld to only trusted management subnets:

```

firewall-cmd --permanent --remove-service=postgresql

firewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24

firewall-cmd --reload

```

2. Alternatively, ensure the server only binds to loopback interfaces by setting `listen_addresses = 'localhost'` in the PostgreSQL configuration and reloading the service:

```

systemctl reload postgresql

```

Caveats:

Restricting network access only limits the attack surface from external untrusted networks. It does not prevent exploitation by authenticated database users connecting from permitted IP addresses or via local connections.

Warning:

Reloading firewall rules or the PostgreSQL service modifies active connection filtering and client sessions. Plan and test these configuration adjustments to avoid unintended service interruption.