Description
IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pgvector | < 0.8.7 | 0.8.7 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pgvector | 0.8.7-1 | — |
| Debian 13 | pgvector | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pgvector | No fix yet | — |
| Ubuntu 26.04 LTS | pgvector | No fix yet | — |
| Ubuntu 24.04 LTS | pgvector | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | pgvector +2 | 0.8.7-1.el10_2 | RHSA-2026:88360, RHSA-2026:88359 |
| RHEL 9 | pg_repack | 1.5.1-1.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
| RHEL 9 | pgaudit | 16.0-1.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
| RHEL 9 | pgvector | 0.8.7-1.module+el9.8.0+25064+c8e71655 | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
| RHEL 9 | postgis +4 | 3.5.3-6.module+el9.8.0+24839+3a67b9ca | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
| RHEL 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
| RHEL 9 | postgresql +14 | 16.15-1.module+el9.8.0+24803+9dca000b | RHSA-2026:97875, RHSA-2026:85814, RHSA-2026:85791 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | pgvector +1 | 0.8.7-1.el10_0 | RHSA-2026:95521 |
| RHEL 9.6 EUS | pg_repack | 1.5.1-1.module+el9.6.0+22880+6b241eec | RHSA-2026:93460 |
| RHEL 9.6 EUS | pgaudit | 16.0-1.module+el9.4.0+20427+07482b8c | RHSA-2026:93460 |
| RHEL 9.6 EUS | pgvector | 0.8.7-1.module+el9.6.0+25207+17f809b9 | RHSA-2026:93460 |
| RHEL 9.6 EUS | postgres-decoderbufs | 2.4.0-1.Final.module+el9.4.0+20427+07482b8c | RHSA-2026:93460 |
| RHEL 9.6 EUS | postgresql +14 | 16.15-1.module+el9.6.0+24915+52fd15c1 | RHSA-2026:93460 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | pgvector +1 | 0.8.7-1.el10_2 | ALSA-2026:88360, ALSA-2026:88359 |
| AlmaLinux 9 | pg_repack | 1.5.1-1.module_el9.6.0+146+c54fdeca | ALSA-2026:85814, ALSA-2026:85791 |
| AlmaLinux 9 | pgaudit | 16.0-1.module_el9.4.0+66+eb9878bc | ALSA-2026:85814, ALSA-2026:85791 |
| AlmaLinux 9 | pgvector | 0.8.7-1.module_el9.8.0+324+0cb93d9d | ALSA-2026:85814, ALSA-2026:85791 |
| AlmaLinux 9 | postgis +4 | 3.5.3-6.module_el9.8.0+311+c39b793b | ALSA-2026:85814, ALSA-2026:85791 |
| AlmaLinux 9 | postgres-decoderbufs | 2.4.0-1.Final.module_el9.4.0+66+eb9878bc | ALSA-2026:85814, ALSA-2026:85791 |
| AlmaLinux 9 | postgresql +14 | 16.15-1.module_el9.8.0+311+c39b793b | ALSA-2026:85814, ALSA-2026:85791 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | postgresql16-pgvector +1 | 0.8.7-1.el10_2 | RLSA-2026:88360, RLSA-2026:88359 |
| Rocky Linux 9 | pg_repack | 1.5.1-1.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:85814, RLSA-2026:85791 |
| Rocky Linux 9 | pgaudit | 16.0-1.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:85814, RLSA-2026:85791 |
| Rocky Linux 9 | postgis | 3.5.3-6.module+el9.8.0+40320+f6f9ed3c | RLSA-2026:97875, RLSA-2026:85814, RLSA-2026:85791 |
| Rocky Linux 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:85814, RLSA-2026:85791 |
| Rocky Linux 9 | postgresql | 16.15-1.module+el9.8.0+40320+f6f9ed3c | RLSA-2026:97875, RLSA-2026:85814, RLSA-2026:85791 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | pgvector +3 | 0.8.7-150600.13.12.1 | SUSE-SU-2026:4804-1 |
| SLES 15 SP6 | pgvector +3 | 0.8.7-150600.13.12.1 | SUSE-SU-2026:4804-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | pgvector +6 | 0.8.7-160000.1.1 | SUSE-SU-2026:24211-1 |
| SLES for SAP 15 SP6 | pgvector +3 | 0.8.7-150600.13.12.1 | SUSE-SU-2026:4804-1 |
| SLES 16.0 | pgvector +6 | 0.8.7-160000.1.1 | SUSE-SU-2026:24211-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pgvector | 0.8.7-1.1 | openSUSE-SU-2026:12067-1 |
| openSUSE Leap 16.0 | pgvector +6 | 0.8.7-160000.1.1 | openSUSE-SU-2026:22065-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | pgvector +1 | 0.8.7-1.el10_2 | ELSA-2026-88360, ELSA-2026-88359 |
| Oracle Linux 9 | pg_repack | 1.5.1-1.module+el9.8.0+91036+1d936f05 | ELSA-2026-85814, ELSA-2026-85791 |
| Oracle Linux 9 | pgaudit | 16.0-1.module+el9.8.0+91036+1d936f05 | ELSA-2026-85814, ELSA-2026-85791 |
| Oracle Linux 9 | pgvector | 0.8.7-1.module+el9.8.0+91070+9d37edeb | ELSA-2026-85814, ELSA-2026-85791 |
| Oracle Linux 9 | postgis +4 | 3.5.3-6.module+el9.8.0+91036+1d936f05 | ELSA-2026-85814, ELSA-2026-85791 |
| Oracle Linux 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+91036+1d936f05 | ELSA-2026-85814, ELSA-2026-85791 |
| Oracle Linux 9 | postgresql +14 | 16.15-1.module+el9.8.0+91070+9d37edeb | ELSA-2026-85814, ELSA-2026-85791 |
Advisories 25
- RHSA-2026:97875 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:95521 Red Hat Security Advisory: postgresql16-pgvector security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:93460 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88360 Red Hat Security Advisory: postgresql18-pgvector security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:88359 Red Hat Security Advisory: postgresql16-pgvector security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4029 Red Hat Enterprise Linux (python-tornado, resteasy-core, bubblewrap, pgvector): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- RLSA-2026:97875 Important: postgresql:16 security update Rocky Linux Security Advisories · Nov 11, 2026
- ALSA-2026:85791 Important: postgresql:16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:85814 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:88360 Important: postgresql18-pgvector security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:88359 Important: postgresql16-pgvector security update AlmaLinux Security Advisories · Oct 29, 2026
- RLSA-2026:88359 Important: postgresql16-pgvector security update Rocky Linux Security Advisories · Oct 23, 2026
- RLSA-2026:88360 Important: postgresql18-pgvector security update Rocky Linux Security Advisories · Oct 23, 2026
- ELSA-2026-88360 Important: postgresql18-pgvector security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 22, 2026
- ELSA-2026-88359 Important: postgresql16-pgvector security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Oct 22, 2026
- SUSE-SU-2026:4804-1 Security update for pgvector SUSE / openSUSE Security Updates · Oct 21, 2026
- SUSE-SU-2026:24211-1 Security update for pgvector SUSE / openSUSE Security Updates · Oct 21, 2026
- RLSA-2026:85791 Important: postgresql:16 security update Rocky Linux Security Advisories · Oct 20, 2026
- RLSA-2026:85814 Important: postgresql:18 security update Rocky Linux Security Advisories · Oct 20, 2026
- RHSA-2026:85814 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:85791 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- ELSA-2026-85814 Important: postgresql:18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- ELSA-2026-85791 Important: postgresql:16 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Oct 20, 2026
- openSUSE-SU-2026:22065-1 Security update for pgvector SUSE / openSUSE Security Updates · Oct 19, 2026
- openSUSE-SU-2026:12067-1 pgvector-devel-0.8.7-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026