Back to Security Advisories

Postgresql18-Pgvector Security Update — AlmaLinux 10 (ALSA-2026:88360)

ALSA-2026:88360 updates the pgvector extension for PostgreSQL 18 on AlmaLinux 10, fixing CVE-2026-103484 — arbitrary code execution via an out-of-bounds write during IVF (inverted file index) operations. Servers using pgvector for AI/vector similarity workloads should update the package: dnf update pgvector and re-confirm the extension version in each database.

High 8.8 CVSS
AlmaLinux 10

What this means under a SharedLicense license

An out-of-bounds write reachable through index operations means a malicious or malformed query against a vector index can execute code in the database process — the highest-value compromise on any data server.

Type:

security

Severity:

important

Release date:

2026-10-24

Description:

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance

Security Fix(es):

* pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture Package Checksum
aarch64 postgresql18-pgvector-0.8.7-1.el10_2.aarch64.rpm cb0b67fbb22ddeabbd821c4ab7f629a2f6c293811804bf39592ca34f591b0a3d
ppc64le postgresql18-pgvector-0.8.7-1.el10_2.ppc64le.rpm 712b28644f5844f0017166de484033d0d72e651aaaf5f69c5aca85461a9f27a4
s390x postgresql18-pgvector-0.8.7-1.el10_2.s390x.rpm 4c30336ab802a15a0d56766a2df02565def5a8ca7a61d4720867033c2e54d9ca
x86_64 postgresql18-pgvector-0.8.7-1.el10_2.x86_64.rpm c35fc52400666db313151bdccd49b35376c2de89e46875a9ef9d77e59c7ee705
x86_64_v2 postgresql18-pgvector-0.8.7-1.el10_2.x86_64_v2.rpm d7880b1862b150879cf26c1a0b85732abc1c4d1c7afb3fb21bfa2127be0ff771

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Frequently Asked Questions

What is CVE-2026-103484?
It is an arbitrary code execution flaw in pgvector caused by an out-of-bounds write during IVF index handling. AlmaLinux ships the fix in the postgresql18-pgvector package update (ALSA-2026:88360, rated Important).
Who is affected by this pgvector flaw?
PostgreSQL 18 servers on AlmaLinux 10 with the pgvector extension installed and in use — typically AI embedding and similarity-search workloads. Applications querying the index can reach the vulnerable code path without local access.
How do I apply the fix?
Run dnf update postgresql18-pgvector (or a general dnf update), restart PostgreSQL, and verify the extension version with SELECT extversion FROM pg_extension WHERE extname = 'vector';
Is a CVSS score published for CVE-2026-103484?
No score is listed in the erratum data so far. AlmaLinux rates the update Important; treat vector-index workloads as exposed and update promptly since the flaw class is code execution.

References

Security Advisories

Related Advisories

Nodejs-Nodemon Security Update — AlmaLinux 10 (ALSA-2026:96236)

2026-11-10

Nodejs22 Security Update — AlmaLinux 10 (ALSA-2026:96094)

2026-11-10

Nodejs24 Security Update — AlmaLinux 10 (ALSA-2026:96088)

2026-11-10

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System