CVE-2026-61822

pg_partman disable maintenance for all partition sets

State
Published
Severity
6.5 Medium
Published
Sep 18, 2026
Updated
Sep 24, 2026
Reserved
Jul 10, 2026

Read the record on cve.org

Description

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.

Scores

CVSSScoreVectorSource
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HGitHub_M

Weaknesses

  • CWE-703 Improper Check or Handling of Exceptional Conditions

Affected Products

ProductVersions
pg_partmanpgpartman
  • < 5.5.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.