CVE-2026-3172
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Feb 25, 2026
CISA due date
—
The record
Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | postgresql16-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | postgresql17-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | postgresql18-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | postgresql16-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | postgresql17-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server 15 SP6-LTSS | postgresql18-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | postgresql16-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | postgresql17-pgvector | 0 | 0.8.2-150600.13.9.1 |
| SUSE:Linux Enterprise Server for SAP Applications 15 SP6 | postgresql18-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql13-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql14-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql15-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql16-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql17-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 15.6 | postgresql18-pgvector | 0 | 0.8.2-150600.13.9.1 |
| openSUSE:Leap 16.0 | pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql13-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql14-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql15-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql16-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql17-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Leap 16.0 | postgresql18-pgvector | 0 | 0.8.2-160000.1.1 |
| openSUSE:Tumbleweed | pgvector | 0 | 0.8.2-1.1 |
Related vulnerabilities
- CVE-2025-12817 Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to… Also affects postgresql13-pgvector
- CVE-2025-12818 Integer wraparound in multiple PostgreSQL libpq client library functions allows an… Also affects postgresql13-pgvector
- CVE-2026-88833 A flaw was found in BusyBox's udhcpc DHCP client. CWE-191
- CVE-2026-44235 rabbitmq-c is a C-language AMQP client library for RabbitMQ. CWE-191
- CVE-2026-81977 Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability… CWE-191
- CVE-2026-66767 SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated… CWE-191
- CVE-2026-18341 IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt… CWE-191
- CVE-2026-9624 A denial-of-service security issue exists within RSLinx® Classic. CWE-191