CVE catalog

CVE-2026-3172

pgvector-devel-0.8.2-1.1 on GA media

[CVE catalog]

Severity
Medium · CVSS 6.8CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
0.39% · Oct 25, 2026

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpgvector130.8.0-1vulnerable
Debianpgvector130.8.1-1vulnerable
Debianpgvector130.8.1-2vulnerable
Debianpgvector130.8.2-1vulnerable
Debianpgvector130.8.3-1vulnerable
Debianpgvector130.8.4-1vulnerable
Debianpgvector130.8.5-1vulnerable
Debianpgvector130.8.6-1vulnerable
Debianpgvector140.8.0-1vulnerable
Debianpgvector140.8.1-1vulnerable
Debianpgvector140.8.1-2vulnerable
Debianpgvector140.8.2-1fixed
Opensusepgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql13-pgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql14-pgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql15-pgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql16-pgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql17-pgvectorleap 16.00.8.2-160000.1.1fixed
Opensusepostgresql18-pgvectorleap 16.00.8.2-160000.1.1fixed
Susepgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql13-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql14-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql15-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql16-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql17-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepostgresql18-pgvectorlinux enterprise server 16.00.8.2-160000.1.1fixed
Susepgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql13-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql14-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql15-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql16-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql17-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepostgresql18-pgvectorlinux enterprise server for sap applications 16.00.8.2-160000.1.1fixed
Susepgvectorlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1fixed
Susepostgresql16-pgvectorlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1fixed
Susepostgresql17-pgvectorlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1fixed
Susepostgresql18-pgvectorlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1fixed
Susepgvectorlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1fixed
Susepostgresql16-pgvectorlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1fixed
Susepostgresql17-pgvectorlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1fixed
Susepostgresql18-pgvectorlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1fixed
Susepgvectorlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1fixed
Susepostgresql16-pgvectorlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1fixed
Susepostgresql17-pgvectorlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1fixed
Susepostgresql18-pgvectorlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1fixed
Opensusepgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql13-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql14-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql15-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql16-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql17-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepostgresql18-pgvectorleap 15.60.8.2-150600.13.9.1fixed
Opensusepgvectortumbleweed0.8.2-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpgvectordeb140.8.2-1Not reportedDEBIAN-CVE-2026-3172Not reported
Opensusepgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql13-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql14-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql15-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql16-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql17-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Opensusepostgresql18-pgvectorrpmleap 16.00.8.2-160000.1.1Not reportedOPENSUSE-SU-2026:20489-1Not reported
Susepgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql13-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql14-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql15-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql16-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql17-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql18-pgvectorrpmlinux enterprise server 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql13-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql14-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql15-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql16-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql17-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepostgresql18-pgvectorrpmlinux enterprise server for sap applications 16.00.8.2-160000.1.1Not reportedSUSE-SU-2026:21153-1Not reported
Susepgvectorrpmlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql16-pgvectorrpmlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql17-pgvectorrpmlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql18-pgvectorrpmlinux enterprise module for server applications 15 sp70.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepgvectorrpmlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql16-pgvectorrpmlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql17-pgvectorrpmlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql18-pgvectorrpmlinux enterprise server 15 sp6-ltss0.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepgvectorrpmlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql16-pgvectorrpmlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql17-pgvectorrpmlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Susepostgresql18-pgvectorrpmlinux enterprise server for sap applications 15 sp60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql13-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql14-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql15-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql16-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql17-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepostgresql18-pgvectorrpmleap 15.60.8.2-150600.13.9.1Not reportedSUSE-SU-2026:1068-1Not reported
Opensusepgvectorrpmtumbleweed0.8.2-1.1Not reportedOPENSUSE-SU-2026:10409-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [postgresql-17-pgvector]Affected

    Source package: [pgvector]

    Details (2)

    • 0.8.0-1 · amd64 · trixie

      Affected

      pypi · pgvector · debian · 13

    • 0.8.0-1 · arm64 · trixie

      Affected

      pypi · pgvector · debian · 13

[openSUSE Tumbleweed]

  • [pgvector-devel]Unknown

    Source package: [pgvector]

    Details (1)

    • 0.8.3-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 0.8.2-1.1

      Version impact unknown

      pypi · pgvector · opensuse · tumbleweed

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]