Your message dated Thu, 30 Jul 2026 21:27:55 +0200 with message-id <[email protected]> and subject line Re: Bug#1143128: pgvector: CVE-2026-18022 has caused the Debian Bug report #1143128, regarding pgvector: CVE-2026-18022 to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 1143128: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1143128 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Source: pgvector Version: 0.8.5-1 Severity: grave Tags: security upstream Forwarded: https://github.com/pgvector/pgvector/issues/1006 X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]> Hi, The following vulnerability was published for pgvector. CVE-2026-18022[0]: | Integer wraparound in IVFFlat index build in pgvector before 0.8.6 | allows a database user to write data out-of-bounds, which could lead | to arbitrary code execution. Only 32-bit systems are affected. Despite the severity I guess for trixie it is enough to make a fix only via an upcomping point release as it only affects 32bit systems. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-18022 https://www.cve.org/CVERecord?id=CVE-2026-18022 [1] https://github.com/pgvector/pgvector/issues/1006 [2] https://github.com/pgvector/pgvector/commit/636a92a3395d2e036ffd40d07aeb400a708ae104 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
--- End Message ---
--- Begin Message ---Re: Salvatore Bonaccorso > Despite the severity I guess for trixie it is enough to make a fix > only via an upcomping point release as it only affects 32bit systems. Hi Salvatore, thanks for the report! We stopped building 32-bit package for PostgreSQL extensions some time ago because upstreams are increasingly unwilling/unable to fix problems, and the time spend debugging wasn't worth the estimated non-existing 32-bit user base. So: We are not affected. $ rmadison postgresql-{10..19}-pgvector postgresql-17-pgvector | 0.8.0-1 | stable | amd64, arm64, ppc64el, riscv64, s390x postgresql-18-pgvector | 0.8.5-1 | testing | amd64, arm64, loong64, ppc64el, riscv64, s390x postgresql-18-pgvector | 0.8.5-1 | unstable | amd64, arm64, loong64, ppc64el, riscv64, s390x Christoph
--- End Message ---
