redhat/postgresql:18/pgvector vulnerabilities

Latest redhat/postgresql:18/pgvector CVEs

Newest publication first

1. CVE-2026-18022 pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems

   Published 2026-07-29

   High·CVSS 8.8

   Integer wraparound in IVFFlat index build in pgvector before 0.8.6 allows a database user to write data out-of-bounds, which could lead to arbitrary code execution. Only 32-bit systems are affected.

2. CVE-2026-3172 pgvector buffer overflow in parallel HNSW index build

   Published 2026-02-25

   High·CVSS 8.1

   Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.