PoC Released for 20-Year Old PostgreSQL RCE Flaw

**Executive summary:** A public proof-of-concept exploit was released for CVE-2026-2005, a heap-based buffer overflow in PostgreSQL's pgcrypto extension that allows remote code execution and escalation to superuser by abusing a session-key parsing overflow; the upstream patch was issued in February 2026 and mitigations and patched versions are listed.