Response Status for the PostgreSQL Vulnerability (CVE-2026-116304)

Published: 2026-11-12

This notice describes Kuroco's response status for the PostgreSQL vulnerability (CVE-2026-116304).

The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 on November 12, 2026. These releases fix a use-after-free vulnerability in the coordination of anonymous RECORD type identifiers among parallel workers. If exploited, this vulnerability allows a database user to execute arbitrary code as the operating system user running the database.

The CVSS 3.0 base score is 8.8. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Response status

We are currently investigating whether Kuroco is affected. We will update this page once the investigation is complete.

Last updated: 2026/11/12

References

• PostgreSQL: CVE-2026-116304

Contact

If you have any questions about this matter, please feel free to contact Kuroco support.

• Support

Related Documents

• Security Advisories
• Security Center