CVE-2026-3172

Description

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

PUBLISHED Reserved 2026-02-24 | Published 2026-02-25 | Updated 2026-02-26 | Assigner PostgreSQL

Problem types

Integer Underflow or Wraparound

Out-of-bounds Write

Credits

Thanks to chungkn from OneMount Group for reporting this.

References

github.com/pgvector/pgvector/issues/959

cve.org (CVE-2026-3172)

nvd.nist.gov (CVE-2026-3172)

Download JSON