GoKawiilResearcher finds 22-year-old type-confusion bug in PostgreSQL core enabling RCE
A security researcher discovered a previously unknown memory-corruption vulnerability in PostgreSQL's core code, dating back 22 years, that can be triggered through type confusion in composite data types. The flaw was uncovered while investigating a separate exploit in the pg_clickhouse extension, and was developed into a reliable remote-code-execution exploit. The work is detailed in the third post of a series on systemic risks in managed PostgreSQL services.
GoKawiil's interpretation of the reporting above, not reported fact.
A memory-corruption bug surviving undetected for over two decades in one of the world's most widely used open-source databases suggests gaps in how long-standing core code gets security-reviewed, even as extensions receive more scrutiny. Because PostgreSQL underpins countless managed cloud database offerings, a reliable RCE path in its core could have broad implications for hosting providers once technical details and patches become public. The researcher's series framing suggests they see this as part of a larger pattern of risk across managed PostgreSQL providers, though that broader claim is the researcher's own characterization.
- A 22-year-old type-confusion vulnerability was found in PostgreSQL's core, not an extension.
- The bug was discovered incidentally while exploiting the pg_clickhouse extension, using an AI agent to explore internals.
- The flaw reportedly produces a reliable path to remote code execution via memory corruption.
Source: mehmetince.net — Mehmet Ince, 2026-11-12
Published there as: “22-Year-Old PostgreSQL Bug Turned into Remote Code Execution”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.