Subject: pgsql: Guard against unexpected dimensions of oidvector/int2vector.

From: Tom Lane <[email-masked]>
Date: Mon, 09 Feb 2026 15:15:05 +0000

Guard against unexpected dimensions of oidvector/int2vector.

These data types are represented like full-fledged arrays, but
functions that deal specifically with these types assume that the
array is 1-dimensional and contains no nulls.  However, there are
cast pathways that allow general oid[] or int2[] arrays to be cast
to these types, allowing these expectations to be violated.  This
can be exploited to cause server memory disclosure or SIGSEGV.
Fix by installing explicit checks in functions that accept these
types.

Reported-by: Altan Birler <[email-masked]>
Author: Tom Lane <[email-masked]>
Reviewed-by: Noah Misch <[email-masked]>
Security: CVE-2026-2003
Backpatch-through: 14

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/60e7ae41a6987ed05dcfe87bddaccac8e1e93126

Modified Files
--------------
src/backend/access/hash/hashfunc.c     |  3 +++
src/backend/access/nbtree/nbtcompare.c |  4 ++++
src/backend/utils/adt/format_type.c    |  6 +++++-
src/backend/utils/adt/int.c            | 31 ++++++++++++++++++++++++++++++-
src/backend/utils/adt/oid.c            | 31 ++++++++++++++++++++++++++++++-
src/include/utils/builtins.h           |  1 +
src/test/regress/expected/arrays.out   |  5 +++++
src/test/regress/sql/arrays.sql        |  4 ++++
8 files changed, 82 insertions(+), 3 deletions(-)