Skip to content
Heist/ feed
High

Type confusion in AWS pgcollection allows remote code execution

Type: advisorySource: Official CVE List1 source record

pgcollection is an open source extension to PostgreSQL. A type confusion issue in AWS pgcollection 2.0.0 through 2.1.1 might allow an authenticated remote user to execute arbitrary code as the postgres operating system user via crafted SQL statements that rely on mismatched type metadata in collection value retrieval and array conversion functions. To remediate this issue, users should upgrade to version 2.1.2 or later.

Announced Source revision 1
Original source ↗

CVE-2026-96883

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-96883

pgcollection

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "vendor": "AWS",
    "product": "pgcollection",
    "versions": [
      {
        "status": "affected",
        "version": "2.0.0",
        "versionType": "custom",
        "lessThanOrEqual": "2.1.1"
      }
    ],
    "defaultStatus": "unaffected"
  }
]
Related CVEs
CVE-2026-96883

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#1872 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement