Resolved issues
Resolved issues release notes for 26.3.x.
26.3.0-0
Updated 9/8/2026
| Issue Key | Application Module | Description |
|---|---|---|
| 114511 | UI - Management Console | Fixed an issue with a documentation link in the MC load monitor page. |
| 114340 | UI - Management Console | Validated that Vertica Management Console is not impacted by CVE-2024-22233, CVE-2024-22234, CVE-2024-22236, or CVE-2024-22243. |
| 105839 | Execution Engine | Queries employing the LISTAGG aggregate function with the WITHIN GROUP clause were experiencing high network data transfer and prolonged execution times due to excessive buffer allocation. This was leading to severe performance degradation for the affected query and other concurrent database operations, potentially causing database instability or halts. This update provides significant improvements to both memory and time performance by fixing the buffer allocation. |
| 100267 | UI - Management Console | Fixed an issue in the Management Console where the Query Plan screen showed no profile information for queries run from the Query Execution screen. |
| 25714 | EON | Fixed a file leak in Eon Mode where delete vector files associated with temporary tables were not cleaned up after the table was dropped or the session was reset. |
| 25616 | Security | Fixed a security issue in the Vertica Operator where the dbadmin user was assigned an empty password when the passwordSecret property was not configured in the Custom Resource Definition (CRD). |
| 25615 | License | Fixed an issue where license audits were reporting incorrect table sizes due to undercounting bytes at load time. |
| 25453 | UI - Management Console | This update addresses a security vulnerability, CVE-2022-35980, identified in the Management Console where user input fields were not properly sanitized against injection attacks. |
| 25331 | Client Drivers - ADO | Fixed an issue in the ADO.NET driver where setting a non-zero ConnectionTimeout value caused VerticaConnection.Open() to serialize parallel connection attempts, resulting in significantly increased latency. |
| 25311 | Security | This update addresses multiple critical and high-severity CVEs. |
| 25305 | Kubernetes | This update addresses multiple high-severity CVEs (CVE-2026-25679, CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-24051, CVE-2026-39883, CVE-2026-29181, CVE-2026-35469) identified in third-party dependencies of the VerticaDB Operator, including the Go standard library, OpenTelemetry SDK, and moby/spdystream. |
| 25217 | Security | This update addresses multiple high-severity CVEs identified in various third-party components bundled with Vertica. |
| 25131 | Security | This update addresses a critical security vulnerability, CVE-2026-34480. This vulnerability affects our Vertica Database Cluster, specifically the Log4j library used within the Kafka package. To remediate this vulnerability, the Log4j library has been upgraded from version 2.17.1 to the recommended fixed version 2.25.4. |
| 25009 | Security | This update addresses high-severity security vulnerabilities identified in bundled Python dependencies by upgrading pyOpenSSL and pyasn1 to patched versions. |
| 24877 | Third Party Tools Integration | This update addresses multiple security vulnerabilities (CVE-2023-32002, CVE-2023-32003, CVE-2023-32004, CVE-2023-32005, CVE-2023-32006, CVE-2023-32558, CVE-2023-32559, CVE-2024-28863) identified in Node.js and the node-tar module used by the Management Console. |
| 24662 | Optimizer | Certain combinations of expressions, sublinks, and group by used in a single query could result in an internal error; this has been resolved. |
| 24551 | Client Drivers - JDBC | Fixed an issue where setting NetworkTimeout using JDBC URL or Properties object was being silently dropped for values over 65535ms. |
| 23922 | Installation Program | When installing Vertica on RHEL 9.7 systems utilizing XFS filesystems, the get-disks utility incorrectly reported the I/O block size as 512 bytes instead of the actual 4096 bytes. This discrepancy caused pre-installation checks to fail, preventing successful Vertica deployments. The get-disks utility has been updated to accurately determine the I/O block size for XFS filesystems on RHEL 9.7. |
| 22896 | Security | A critical security vulnerability, CVE-2026-33186, has been identified in the gRPC dependency utilized by Vertica Server. A security patch has been provided that addresses the critical vulnerability while avoiding potential performance impacts associated with upgrading to later versions. |
| 22594 | EON | Fixed an issue in Eon Mode where dropping a schema within a namespace whose name contained dots failed with a "does not exist" error due to incorrect parsing of the qualified object name. |
| 22455 | Execution Engine | Fixed an issue where the database could crash while executing the replay delete phase of a mergeout operation on projections. |
| 21825 | EON | Fixed an issue where session memory accounting could return an unexpected error to users when a node in another subcluster went down, potentially causing job failures. |
| 21607 | Execution Engine | Fixed an issue with reused Common Table Expressions (CTEs) when they are referenced in multiple distinct aggregate clauses. Previously, the way we handled pruning in these cases could lead to inconsistent results; now, we prune the CTE at the top level to ensure the entire query has the correct column references. |
| 21066 | ComplexTypes | Creating a view with unnest() applied to a CASE expression that returns a complex array type (e.g., ARRAY[ROW(varchar)] or ARRAY[ARRAY[varchar]]) does not fails anymore. |
| 11508 | UI - Management Console | This update addresses a critical security vulnerability, CVE-2025-12453, identified as a Reflected Cross-Site Scripting (XSS) flaw in Vertica, specifically affecting version 10.0.1. Prior to this fix, an authenticated attacker could exploit unmanaged input parameters in certain Web UI endpoints to inject and execute arbitrary JavaScript code. This update includes essential security enhancements to mitigate the identified XSS vulnerability and measures to ensure proper sanitization and neutralization of user-supplied input, preventing the execution of malicious scripts. Users are advised to update to the latest version to benefit from these security improvements. |
| 4492 | Documentation | Corrected the CREATE FLEX TABLE documentation to indicate that the ENCODED BY clause is not supported when creating a flex table from a query (CREATE FLEX TABLE ... AS SELECT). |
| 3217 | Sessions | Session memory accounting now throws fatal errors exclusively. Session memory accounting applies only to execute and query messages with high potential memory impact. |
| 2923 | HTTP | Fixed an issue where the MCP Server DSN builder did not percent-encode passwords, causing connection failures for passwords containing URL-reserved characters such as @, :, or #. |
| 2913 | S3 | Fixed an issue where a node could crash with an unexpected exception while accessing the Glue metadata location during query execution. |
| 2898 | Security | Strengthened the Management Console Content Security Policy (CSP) header by removing the unsafe-inline and unsafe-eval directives to reduce exposure to cross-site scripting attacks. |
| 2861 | Backup/DR | Server-side encryption (SSE) settings are now correctly applied during VBR init task. |
| 2855 | Optimizer | Fixed a memory over-allocation issue in the GroupByHash operator during distributed two-phase aggregation where Phase 2 processing consumed excessive memory for high-cardinality columns, causing unnecessary spills to disk regardless of the available memory pool size. |
| 2851 | Backup/DR | Fixed an issue where vbr -t init failed with an authentication error because vbr incorrectly passed an empty password to vcluster when collecting cluster information. |
| 2282 | Kubernetes | Fixed a security issue in the Vertica Operator where TLS authentication records created when client-server TLS was enabled had fallthrough to password-based authentication enabled by default. When client-server TLS is enabled, remote database connections are now restricted to TLS authentication only. Local connections can still use TLS or password authentication. |
| 2189 | UI - Management Console | Fixed an issue that was causing 'Connection timed out' errors when attempting to log in to the Vertica Management Console (MC) via a reverse proxy. |
| 1821 | Client Drivers - JDBC | Fixed an intermittent TLS connection failure where clients using mutual TLS (mTLS) through a TLS-terminating proxy could fail with a fatal "session id context uninitialized" error when attempting TLS session resumption. |
| 1402 | Security | This update addresses multiple security vulnerabilities identified in third-party components bundled with Vertica Server and the Vertica Operator, including Python 3.13, Go standard library, and associated Go modules used by the Node Management Agent, Prometheus integration, and MCP Server. |
| 1168 | Installation Program | When installing Vertica on RHEL 9.7 systems utilizing XFS filesystems, the get-disks utility incorrectly reported the I/O block size as 512 bytes instead of the actual 4096 bytes. This discrepancy caused pre-installation checks to fail, preventing successful Vertica deployments. The get-disks utility has been updated to accurately determine the I/O block size for XFS filesystems on RHEL 9.7. |