{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-61822 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-61822 is a medium-severity denial of service vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-61822 and fix it if it is affected.\n\nWhat it is: CVE-2026-61822 is a medium-severity denial of service vulnerability in pgpartman pg_partman, published on 18 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-61822 in the wild and no public exploit code.\n\nAffected product: pgpartman pg_partman. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-61822/ (Markdown: https://insights.sbomify.com/CVE-2026-61822/index.md)","id":"CVE-2026-61822","markdown":"https://insights.sbomify.com/CVE-2026-61822/index.md","name":"CVE-2026-61822","record":{"aliases":["DEBIAN-CVE-2026-61822","ECHO-ae46-a998-e223","GHSA-9m6c-hw23-c6h2","UBUNTU-CVE-2026-61822"],"analysis":{"component_type":"database","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"PostgreSQL extension","requires_auth":"low_privilege","summary":"An attacker with partman_user access can disrupt automated partition maintenance for all sets by triggering an exception in a low-priority configuration row.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-703","name":"Improper Check or Handling of Exceptional Conditions"}],"description":"pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"pg_partman disable maintenance for all partition sets","id":"CVE-2026-61822","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute","id":"CVE-2026-61823"},"packages":[],"prev":{"headline":"pg_partman authorization bypass to move child tables between schemas during retention","id":"CVE-2026-61821"},"products":["pg_partman"],"published":"2026-09-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-09-24","vendors":["pgpartman"]},"summary":"An attacker with partman_user access can disrupt automated partition maintenance for all sets by triggering an exception in a low-priority configuration row.","url":"https://insights.sbomify.com/CVE-2026-61822/"}