Postgresql18-Pgvector Security Update — AlmaLinux 10 (ALSA-2026:88360)

ALSA-2026:88360 updates the pgvector extension for PostgreSQL 18 on AlmaLinux 10, fixing CVE-2026-103484 — arbitrary code execution via an out-of-bounds write during IVF (inverted file index) operations. Servers using pgvector for AI/vector similarity workloads should update the package: dnf update pgvector and re-confirm the extension version in each database.

High 8.8 CVSS 2026-10-24

AlmaLinux 10

Was das unter einer SharedLicense-Lizenz bedeutet

An out-of-bounds write reachable through index operations means a malicious or malformed query against a vector index can execute code in the database process — the highest-value compromise on any data server.

Type:

security

Severity:

important

Release date:

2026-10-24

Description:

Open-source vector similarity search for Postgres. Supports L2 distance, inner product, and cosine distance

Security Fix(es):

* pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	postgresql18-pgvector-0.8.7-1.el10_2.aarch64.rpm	cb0b67fbb22ddeabbd821c4ab7f629a2f6c293811804bf39592ca34f591b0a3d
ppc64le	postgresql18-pgvector-0.8.7-1.el10_2.ppc64le.rpm	712b28644f5844f0017166de484033d0d72e651aaaf5f69c5aca85461a9f27a4
s390x	postgresql18-pgvector-0.8.7-1.el10_2.s390x.rpm	4c30336ab802a15a0d56766a2df02565def5a8ca7a61d4720867033c2e54d9ca
x86_64	postgresql18-pgvector-0.8.7-1.el10_2.x86_64.rpm	c35fc52400666db313151bdccd49b35376c2de89e46875a9ef9d77e59c7ee705
x86_64_v2	postgresql18-pgvector-0.8.7-1.el10_2.x86_64_v2.rpm	d7880b1862b150879cf26c1a0b85732abc1c4d1c7afb3fb21bfa2127be0ff771

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is CVE-2026-103484?

It is an arbitrary code execution flaw in pgvector caused by an out-of-bounds write during IVF index handling. AlmaLinux ships the fix in the postgresql18-pgvector package update (ALSA-2026:88360, rated Important).

Who is affected by this pgvector flaw?

PostgreSQL 18 servers on AlmaLinux 10 with the pgvector extension installed and in use — typically AI embedding and similarity-search workloads. Applications querying the index can reach the vulnerable code path without local access.

How do I apply the fix?

Run dnf update postgresql18-pgvector (or a general dnf update), restart PostgreSQL, and verify the extension version with SELECT extversion FROM pg_extension WHERE extname = 'vector';

Is a CVSS score published for CVE-2026-103484?

No score is listed in the erratum data so far. AlmaLinux rates the update Important; treat vector-index workloads as exposed and update promptly since the flaw class is code execution.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen