Skip to content
Critical Vulnerability in pgcollection Extension Allows Code Execution

Critical Vulnerability in pgcollection Extension Allows Code Execution

First seen 24 Sep 2026, 23:25 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 24, 2026 at 23:58 UTC
  • •CVE-2026-96883 allows code execution in pgcollection versions 2.0.0 to 2.1.1.
  • •Amazon RDS and Aurora PostgreSQL are not affected by this vulnerability.
  • •Users must upgrade to pgcollection version 2.1.2 or later to mitigate the risk.

A critical vulnerability identified as CVE-2026-96883 affects the pgcollection extension for PostgreSQL. This flaw arises when an authenticated user requests a stored icollection value in an incompatible type, leading to potential backend crashes or arbitrary code execution. The affected versions are pgcollection v2.0.0 through v2.1.1, while Amazon RDS for PostgreSQL and Amazon Aurora PostgreSQL are not impacted due to using version 1.1.1. Users who compiled and deployed pgcollection from the AWS GitHub repository are urged to upgrade to version 2.1.2 or later, as there are no workarounds available. The vulnerability was published on September 24, 2026, and has been addressed in the latest release. Security inquiries can be directed to AWS Security via their reporting page or email.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-24
CVE-2026-96883 published
AWS disclosed a vulnerability in pgcollection affecting versions 2.0.0 to 2.1.1, allowing code execution.
Aws.Amazon
2026-09-24
Patch released for pgcollection
pgcollection version 2.1.2 was released to address the vulnerability identified as CVE-2026-96883.
github.com

More articles in this cluster (3)

Following this threat?

Track Amazon and CVE-2026-96883 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (6)

1 / 3