{"schema_version":"2","view":"grouped","data":[{"id":70979,"cve_ids":["CVE-2026-18022"],"payload":{"kind":"advisory","title":"DEBIAN-CVE-2026-18022","summary":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","evidence":"osv:DEBIAN-CVE-2026-18022","products":[{"name":{"value":"pgvector","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/0/versions"},{"value":"0.8.1-1","evidence":"/affected/0/versions"},{"value":"0.8.1-2","evidence":"/affected/0/versions"},{"value":"0.8.2-1","evidence":"/affected/0/versions"},{"value":"0.8.3-1","evidence":"/affected/0/versions"},{"value":"0.8.4-1","evidence":"/affected/0/versions"},{"value":"0.8.5-1","evidence":"/affected/0/versions"},{"value":"0.8.6-1","evidence":"/affected/0/versions"},{"value":"0.8.7-1","evidence":"/affected/0/versions"}]},{"name":{"value":"pgvector","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.6-1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/1/versions"},{"value":"0.8.1-1","evidence":"/affected/1/versions"},{"value":"0.8.1-2","evidence":"/affected/1/versions"},{"value":"0.8.2-1","evidence":"/affected/1/versions"},{"value":"0.8.3-1","evidence":"/affected/1/versions"},{"value":"0.8.4-1","evidence":"/affected/1/versions"},{"value":"0.8.5-1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"DEBIAN-CVE-2026-18022","aliases":["DEBIAN-CVE-2026-18022"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=trixie","ecosystem":"Debian:13"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1","0.8.6-1","0.8.7-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6-1"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=forky","ecosystem":"Debian:14"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}}],"modified":"2026-10-02T21:00:06.769272592Z","provider":"osv","upstream":["CVE-2026-18022"],"references":["https://security-tracker.debian.org/tracker/CVE-2026-18022"]},"related_cves":[{"value":"CVE-2026-18022","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:583d3572-2f0c-4474-82cb-d911d9b765e1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-18022","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"pgvector","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18022","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-18022","advisory_id":"583d3572-2f0c-4474-82cb-d911d9b765e1","event_types":["advisory"],"published_at":"2026-10-25T22:46:03.576994+00:00","technologies":["core-osv","pgvector"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-29T20:17:02.593+00:00","detail_url":"/advisories/advisory%3A583d3572-2f0c-4474-82cb-d911d9b765e1","group":{"id":"advisory:583d3572-2f0c-4474-82cb-d911d9b765e1","revision":1,"primary_event_id":71352,"change":"published","superseded_by":[],"changed":{"id":71352,"cve_ids":["CVE-2026-18022"],"payload":{"kind":"advisory","title":"DEBIAN-CVE-2026-18022","summary":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","evidence":"osv:DEBIAN-CVE-2026-18022","products":[{"name":{"value":"pgvector","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/0/versions"},{"value":"0.8.1-1","evidence":"/affected/0/versions"},{"value":"0.8.1-2","evidence":"/affected/0/versions"},{"value":"0.8.2-1","evidence":"/affected/0/versions"},{"value":"0.8.3-1","evidence":"/affected/0/versions"},{"value":"0.8.4-1","evidence":"/affected/0/versions"},{"value":"0.8.5-1","evidence":"/affected/0/versions"},{"value":"0.8.6-1","evidence":"/affected/0/versions"},{"value":"0.8.7-1","evidence":"/affected/0/versions"}]},{"name":{"value":"pgvector","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.6-1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/1/versions"},{"value":"0.8.1-1","evidence":"/affected/1/versions"},{"value":"0.8.1-2","evidence":"/affected/1/versions"},{"value":"0.8.2-1","evidence":"/affected/1/versions"},{"value":"0.8.3-1","evidence":"/affected/1/versions"},{"value":"0.8.4-1","evidence":"/affected/1/versions"},{"value":"0.8.5-1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"DEBIAN-CVE-2026-18022","aliases":["DEBIAN-CVE-2026-18022"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=trixie","ecosystem":"Debian:13"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1","0.8.6-1","0.8.7-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6-1"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=forky","ecosystem":"Debian:14"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}}],"modified":"2026-10-02T21:00:06.769272592Z","provider":"osv","upstream":["CVE-2026-18022"],"references":["https://security-tracker.debian.org/tracker/CVE-2026-18022"]},"related_cves":[{"value":"CVE-2026-18022","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:583d3572-2f0c-4474-82cb-d911d9b765e1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-18022","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"pgvector","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18022","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-18022","advisory_id":"583d3572-2f0c-4474-82cb-d911d9b765e1","event_types":["advisory"],"published_at":"2026-10-25T22:46:03.576994+00:00","technologies":["core-osv","pgvector"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-29T20:17:02.593+00:00","detail_url":"/events/71352"},"members":[{"id":71352,"cve_ids":["CVE-2026-18022"],"payload":{"kind":"advisory","title":"DEBIAN-CVE-2026-18022","summary":"Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.","evidence":"osv:DEBIAN-CVE-2026-18022","products":[{"name":{"value":"pgvector","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/0/versions"},{"value":"0.8.1-1","evidence":"/affected/0/versions"},{"value":"0.8.1-2","evidence":"/affected/0/versions"},{"value":"0.8.2-1","evidence":"/affected/0/versions"},{"value":"0.8.3-1","evidence":"/affected/0/versions"},{"value":"0.8.4-1","evidence":"/affected/0/versions"},{"value":"0.8.5-1","evidence":"/affected/0/versions"},{"value":"0.8.6-1","evidence":"/affected/0/versions"},{"value":"0.8.7-1","evidence":"/affected/0/versions"}]},{"name":{"value":"pgvector","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.8.6-1","evidence":"/affected/1/ranges"}],"affected_versions":[{"value":"0.8.0-1","evidence":"/affected/1/versions"},{"value":"0.8.1-1","evidence":"/affected/1/versions"},{"value":"0.8.1-2","evidence":"/affected/1/versions"},{"value":"0.8.2-1","evidence":"/affected/1/versions"},{"value":"0.8.3-1","evidence":"/affected/1/versions"},{"value":"0.8.4-1","evidence":"/affected/1/versions"},{"value":"0.8.5-1","evidence":"/affected/1/versions"}]}],"severity":"high","structured":{"id":"DEBIAN-CVE-2026-18022","aliases":["DEBIAN-CVE-2026-18022"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=trixie","ecosystem":"Debian:13"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1","0.8.6-1","0.8.7-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.6-1"}]}],"package":{"name":"pgvector","purl":"pkg:deb/debian/pgvector?arch=source&distro=forky","ecosystem":"Debian:14"},"versions":["0.8.0-1","0.8.1-1","0.8.1-2","0.8.2-1","0.8.3-1","0.8.4-1","0.8.5-1"],"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-18022.json"},"ecosystem_specific":{"urgency":"unimportant"}}],"modified":"2026-10-02T21:00:06.769272592Z","provider":"osv","upstream":["CVE-2026-18022"],"references":["https://security-tracker.debian.org/tracker/CVE-2026-18022"]},"related_cves":[{"value":"CVE-2026-18022","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:583d3572-2f0c-4474-82cb-d911d9b765e1","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-18022","metrics":[{"format":"CVSS","cvssV3_1":{"version":"3.1","baseScore":8.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}],"products":[{"name":{"value":"pgvector","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-18022","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/DEBIAN-CVE-2026-18022","advisory_id":"583d3572-2f0c-4474-82cb-d911d9b765e1","event_types":["advisory"],"published_at":"2026-10-25T22:46:03.576994+00:00","technologies":["core-osv","pgvector"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-07-29T20:17:02.593+00:00","detail_url":"/events/71352"}]}}],"next_after":70979,"next_before":70979}