pgvector CVE-2026-103484: buffer overflow fix and upgrade path

pgvector 0.8.7 fixes a critical buffer overflow in IVFFlat index builds that can lead to arbitrary code execution. If you run a production RAG system on PostgreSQL with vector search, you need to upgrade and reindex now—especially if you accept user-supplied embeddings or ingest data from external sources.

Who is affected

The vulnerability (CVE-2026-103484) is specific to IVFFlat index construction. You are at risk if:

• You use pgvector versions before 0.8.7
• You have one or more IVFFlat indexes in your database
• Your system processes vector data from untrusted sources (user uploads, third-party APIs, or external document pipelines)

You are not at risk if you use only flat (brute-force) or HNSW indexes, or if you run pgvector 0.8.7 or later.

Step 1: Audit your current pgvector setup

Check your installed version:

SELECT pgvector_version();

If the result is below 0.8.7, proceed to Step 2.

List all indexes and their types:

SELECT schemaname, tablename, indexname, indexdef 
FROM pg_indexes 
WHERE schemaname = 'public' 
ORDER BY indexname;

Look for USING ivfflat in the indexdef column. Count how many IVFFlat indexes you have. Note their names and the tables they index—you will need these names during reindexing.

Estimate the size of each indexed table:

SELECT schemaname, tablename, pg_size_pretty(pg_total_relation_size(schemaname||'.'||tablename)) AS size
FROM pg_tables 
WHERE schemaname = 'public' 
  AND tablename IN (SELECT tablename FROM pg_indexes WHERE indexdef LIKE '%ivfflat%')
ORDER BY pg_total_relation_size(schemaname||'.'||tablename) DESC;

This tells you how long reindexing will take.

Step 2: Plan your upgrade window

Reindexing IVFFlat indexes requires CPU and I/O. Schedule the upgrade during a low-traffic period—typically early morning or weekend for most businesses.

Estimate downtime:

• Extension upgrade: 1–2 minutes (no lock)
• Index rebuild (per index, using REINDEX CONCURRENTLY): 5–30 minutes depending on size
• Query validation: 10–15 minutes

Notify your team. If you run a production RAG system on PostgreSQL + pgvector, pause document ingestion and vector embedding jobs during the upgrade. Resume them only after Step 5.

Step 3: Back up and document

Take a full backup of your PostgreSQL cluster:

pg_dump -Fc -v -h localhost -U postgres dbname > backup_$(date +%Y%m%d_%H%M%S).dump

Test the restore on a non-production machine to confirm it works.

Save the current index definitions to a file:

\o index_definitions.sql
SELECT indexdef || ';' FROM pg_indexes WHERE schemaname = 'public' AND indexdef LIKE '%ivfflat%';
\o

You will use this file to verify that indexes are rebuilt correctly.

Step 4: Upgrade pgvector

Connect to your database as a superuser:

ALTER EXTENSION pgvector UPDATE;

Verify the new version:

SELECT pgvector_version();

It should now show 0.8.7 or later.

Step 5: Rebuild IVFFlat indexes

For each IVFFlat index, run:

REINDEX INDEX CONCURRENTLY index_name;

Using CONCURRENTLY allows read queries to continue during the rebuild. Write operations on the indexed table will be blocked briefly when the new index is swapped in, but the overall lock time is minimal.

Example: if your audit found three indexes named embeddings_idx, documents_idx, and chunks_idx, run:

REINDEX INDEX CONCURRENTLY embeddings_idx;
REINDEX INDEX CONCURRENTLY documents_idx;
REINDEX INDEX CONCURRENTLY chunks_idx;

Monitor progress in a separate session:

SELECT schemaname, tablename, indexname, idx_scan, idx_tup_read, idx_tup_fetch
FROM pg_stat_user_indexes 
WHERE indexname IN ('embeddings_idx', 'documents_idx', 'chunks_idx')
ORDER BY idx_tup_read DESC;

Step 6: Validate and resume

Run a few representative vector search queries and compare results to pre-upgrade baselines:

SELECT id, content, 1 - (embedding <=> query_embedding) AS similarity
FROM documents
ORDER BY embedding <=> query_embedding
LIMIT 10;

Check that result order and similarity scores match your expectations. If you have test data with known nearest neighbors, verify those results first.

Monitor your application logs for errors. Watch database CPU and I/O for 30 minutes after resuming ingestion—reindexed indexes should not cause performance regressions.

Resume document ingestion and embedding jobs.

Common mistakes to avoid

Mistake 1: Reindexing without CONCURRENTLY
Using REINDEX INDEX (without CONCURRENTLY) locks the table and blocks all queries. Always use REINDEX INDEX CONCURRENTLY in production.

Mistake 2: Skipping the backup
If the upgrade fails or you discover data corruption, a backup is your only recovery path. Do not skip this step.

Mistake 3: Upgrading pgvector but not reindexing
The new version prevents future buffer overflows, but does not fix existing indexes. You must rebuild IVFFlat indexes to ensure they were not corrupted by the old version.

Mistake 4: Resuming ingestion before validation
If you restart embedding pipelines before verifying that search results are correct, you risk feeding corrupted data into your RAG system. Validate first.

Mistake 5: Ignoring index size
If you have a 50 GB IVFFlat index, reindexing will take hours. Plan accordingly and communicate the window to stakeholders.

How to automate and monitor upgrades

If you manage multiple PostgreSQL instances with pgvector, automate the upgrade process:

1. Inventory: Query all instances to find pgvector versions and IVFFlat indexes.
2. Schedule: Stagger upgrades across instances to avoid simultaneous reindexing.
3. Execute: Use a PostgreSQL client library (psycopg2 in Python, pg in Node.js) to run the upgrade steps in sequence.
4. Monitor: Log the start and end time of each reindex operation. Alert if any step takes longer than expected.
5. Validate: Run a test query suite against each upgraded instance and compare results to a baseline.

For production RAG systems on PostgreSQL + pgvector, this automation is critical. Your ingestion pipeline, hybrid search, and grounded answer generation all depend on reliable vector indexes. A failed upgrade can cascade into hallucinated or missing citations.

Upgrade checklist

• Check current pgvector version with SELECT pgvector_version()
• Query pg_indexes to identify all IVFFlat indexes
• Estimate reindex time based on table sizes
• Schedule upgrade window during low-traffic period
• Take full PostgreSQL backup and test restore
• Save current index definitions to a file
• Pause document ingestion and embedding jobs
• Run ALTER EXTENSION pgvector UPDATE
• Verify new version is 0.8.7 or later
• Rebuild each IVFFlat index with REINDEX INDEX CONCURRENTLY
• Run test queries and compare to pre-upgrade results
• Monitor logs and database metrics for 30 minutes
• Resume ingestion and embedding pipelines

Related: how we built a company chatbot that cites its sources — it runs on PostgreSQL and pgvector.