CVE-2026-3172: 
PostgreSQL vulnerability analysis and mitigation

CVE-2026-3172 is a buffer overflow vulnerability in the parallel HNSW (Hierarchical Navigable Small World) index build functionality of pgvector, a PostgreSQL extension for vector similarity search. It affects pgvector versions 0.6.0 through 0.8.1 and was disclosed on February 25, 2026, with a fix released in version 0.8.2. The vulnerability was reported by chungkn from OneMount Group and assigned by PostgreSQL as the CNA. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Issue, Red Hat CVE).

The root cause is an integer underflow (CWE-191) during the parallel HNSW index build process that leads to an out-of-bounds write (CWE-787), classified as a buffer overflow. When a database user triggers a parallel index build or reindex operation on an HNSW index, an integer wraparound condition occurs in the memory management logic, causing writes beyond the intended buffer boundary. This can result in memory from adjacent database relations being exposed or the server process crashing. Exploitation requires only low privileges — specifically, the ability to create or reindex an HNSW index — and no user interaction, making it accessible to any authenticated database user with standard DDL permissions (GitHub Issue, Red Hat CVE).

Successful exploitation allows a low-privileged database user to leak sensitive data from other database relations (tables) that share memory with the vulnerable process, or to crash the PostgreSQL database server entirely, causing a denial of service. The confidentiality impact is high, as arbitrary in-memory data from other relations could be exposed, potentially including credentials, PII, or other sensitive application data. Availability is also severely impacted through server crashes, while integrity is not directly affected by this vulnerability (GitHub Issue, Red Hat CVE).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.042%, indicating a low probability of exploitation in the near term. Exploitation requires authenticated database access with DDL privileges (CREATE INDEX or REINDEX), which limits the attack surface compared to fully unauthenticated vulnerabilities (Red Hat CVE, Feedly).

1. Gain database access: Obtain credentials for a PostgreSQL database user with at least the ability to create indexes or reindex existing HNSW indexes (standard CREATE privilege on a table is typically sufficient).
2. Identify a vulnerable pgvector installation: Confirm the target is running pgvector version 0.6.0 through 0.8.1 using SELECT extversion FROM pg_extension WHERE extname = 'vector';.
3. Create or identify an HNSW index: Either create a new HNSW index on a vector column (CREATE INDEX ON table USING hnsw (column vector_l2_ops);) or identify an existing one to reindex.
4. Trigger parallel index build: Ensure max_parallel_workers_per_gather is set to a value greater than 0 (the default in most PostgreSQL configurations), then initiate the index build or REINDEX operation to trigger the parallel worker path.
5. Exploit integer underflow: The parallel build process triggers the integer wraparound, causing an out-of-bounds write; depending on memory layout, this may expose data from adjacent relations in shared memory or crash the server process (GitHub Issue).

• Logs: Unexpected PostgreSQL server crashes (SIGSEGV or similar signals) logged in postgresql.log coinciding with HNSW index build or REINDEX operations; log entries referencing parallel worker processes terminating abnormally.
• Database Activity: Unusual or repeated CREATE INDEX USING hnsw or REINDEX commands issued by low-privileged users, particularly with parallel worker settings enabled, visible in pg_stat_activity or audit logs.
• Process: PostgreSQL background worker processes (postgres: parallel worker) crashing or exiting unexpectedly during index build operations.
• File System: PostgreSQL core dump files generated in the data directory following server crashes during vector index operations.

The fix is available in pgvector version 0.8.2, which resolves the integer underflow in the parallel HNSW index build path. All users running versions 0.6.0 through 0.8.1 should upgrade to 0.8.2 as the primary remediation (GitHub Issue). If an immediate upgrade is not possible, administrators should restrict the ability to create or reindex HNSW indexes to trusted administrative accounts only, and consider setting max_parallel_workers_per_gather = 0 at the session or database level to disable parallel index builds as a temporary workaround. OpenSUSE has also issued security announcements for updated packages (OpenSUSE Advisory).

A technical blog post titled "pgvector 0.8.2 and the trouble with parallel HNSW" was published in May 2026, providing community-level analysis of the vulnerability and the fix (thebuild.com). The PostgreSQL community acknowledged the issue promptly, with the fix released in pgvector 0.8.2 shortly after disclosure. Red Hat tracked the vulnerability for their products, and OpenSUSE issued security announcements for updated pgvector packages. Coverage was also noted in German Linux security media (pro-linux.de).