langgraph-checkpoint-postgres

Version	Released
`3.1.2` patch	Aug 07, 2026
`3.1.1` patch	Jul 30, 2026
`3.1.0` minor 1 CVE	May 12, 2026
`3.1.0a4` pre 1 CVE	May 04, 2026
`3.1.0a3` pre 1 CVE	May 01, 2026
`3.1.0a1` pre 1 CVE	Apr 30, 2026
`3.0.5` patch 1 CVE	Mar 18, 2026
`3.0.4` patch 1 CVE	Jan 31, 2026
`3.0.3` patch 1 CVE	Jan 12, 2026
`3.0.2` patch 1 CVE	Dec 09, 2025
`3.0.1` patch 1 CVE	Nov 06, 2025
`3.0.0` major 1 CVE	Oct 20, 2025
`2.0.25` patch 1 CVE	Oct 07, 2025
`2.0.24` patch 1 CVE	Sep 30, 2025
`2.0.23` patch 1 CVE	Jul 16, 2025
`2.0.22` patch 1 CVE	Jul 10, 2025
`2.0.21` patch 1 CVE	Apr 18, 2025
`2.0.20` patch 1 CVE	Apr 17, 2025
`2.0.19` patch 1 CVE	Mar 20, 2025
`2.0.18` patch 1 CVE	Mar 17, 2025
`2.0.17` patch 1 CVE	Mar 14, 2025
`2.0.16` patch 1 CVE	Mar 07, 2025
`2.0.15` patch 1 CVE	Feb 15, 2025
`2.0.14` patch 1 CVE	Feb 13, 2025
`2.0.13` patch 1 CVE	Jan 16, 2025
`2.0.12` patch 1 CVE	Jan 15, 2025
`2.0.11` patch 1 CVE	Jan 14, 2025
`2.0.10` patch 1 CVE	Jan 09, 2025
`2.0.9` patch 1 CVE	Dec 20, 2024
`2.0.8` patch 1 CVE	Dec 06, 2024
`2.0.7` patch 1 CVE	Dec 03, 2024
`2.0.6` patch 1 CVE	Nov 29, 2024
`2.0.5` patch 1 CVE	Nov 28, 2024
`2.0.4` patch 1 CVE	Nov 26, 2024
`2.0.3` patch 1 CVE	Nov 18, 2024
`2.0.2` patch 1 CVE	Oct 24, 2024
`2.0.1` patch 1 CVE	Oct 08, 2024
`2.0.0` major 1 CVE	Oct 01, 2024
`1.0.11` patch 1 CVE	Sep 30, 2024
`1.0.10` patch 1 CVE	Sep 30, 2024
`1.0.9` patch 1 CVE	Sep 27, 2024
`1.0.8` patch 1 CVE	Sep 23, 2024
`1.0.7` patch 1 CVE	Sep 16, 2024
`1.0.6` patch 1 CVE	Sep 03, 2024
`1.0.5` patch 1 CVE	Aug 30, 2024
`1.0.4` patch 1 CVE	Aug 27, 2024
`1.0.3` patch 1 CVE	Aug 09, 2024
`1.0.2` patch 1 CVE	Aug 08, 2024
`1.0.1` patch 1 CVE	Aug 07, 2024
`1.0.0` initial 1 CVE	Aug 07, 2024

3.1.2 patch

Aug 07, 2026

3.1.1 patch

Jul 30, 2026

3.1.0 minor

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

May 12, 2026

3.1.0a4 pre

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

May 04, 2026

3.1.0a3 pre

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

May 01, 2026

3.1.0a1 pre

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Apr 30, 2026

3.0.5 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Mar 18, 2026

3.0.4 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 31, 2026

3.0.3 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 12, 2026

3.0.2 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Dec 09, 2025

3.0.1 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Nov 06, 2025

3.0.0 major

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Oct 20, 2025

2.0.25 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Oct 07, 2025

2.0.24 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 30, 2025

2.0.23 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jul 16, 2025

2.0.22 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jul 10, 2025

2.0.21 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Apr 18, 2025

2.0.20 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Apr 17, 2025

2.0.19 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Mar 20, 2025

2.0.18 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Mar 17, 2025

2.0.17 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Mar 14, 2025

2.0.16 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Mar 07, 2025

2.0.15 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Feb 15, 2025

2.0.14 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Feb 13, 2025

2.0.13 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 16, 2025

2.0.12 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 15, 2025

2.0.11 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 14, 2025

2.0.10 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Jan 09, 2025

2.0.9 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Dec 20, 2024

2.0.8 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Dec 06, 2024

2.0.7 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Dec 03, 2024

2.0.6 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Nov 29, 2024

2.0.5 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Nov 28, 2024

2.0.4 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Nov 26, 2024

2.0.3 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Nov 18, 2024

2.0.2 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Oct 24, 2024

2.0.1 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Oct 08, 2024

2.0.0 major

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Oct 01, 2024

1.0.11 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 30, 2024

1.0.10 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 30, 2024

1.0.9 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 27, 2024

1.0.8 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 23, 2024

1.0.7 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 16, 2024

1.0.6 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Sep 03, 2024

1.0.5 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 30, 2024

1.0.4 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 27, 2024

1.0.3 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 09, 2024

1.0.2 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 08, 2024

1.0.1 patch

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 07, 2024

1.0.0 initial

1 CVE

CVE-2026-71433 PYSEC-2026-3635 GHSA-47pj-3jcm-6whg PYSEC-2026-3636 Aug 10, 2026

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

5.3 / 10

Medium

Network High Low None Unchanged High None None

Summary

The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string (("memories", "alice") becomes memories.alice) and scoped reads by matching that string with LIKE '<path>%'. Because LIKE has no notion of the . separator, a scoped search or list_namespaces also matched sibling namespaces whose flattened form shares leading characters.

Applications commonly use the namespace as a tenant boundary. Where they do, a read scoped to one namespace could return items belonging to another, without any crafted input — an ordinary scoped request was sufficient.

We have no evidence of this behavior being exploited in the wild.

Affected users / systems

You may be affected if you:

use PostgresStore/AsyncPostgresStore or SqliteStore/AsyncSqliteStore, and
rely on the namespace to separate data between users or tenants, and
have namespace labels where one is a prefix of another (1 and 12, alice and alice2), or labels containing _ or %

Applications whose namespace labels are fixed-length identifiers such as UUIDs, containing no _ or %, are not affected — no such label can be a prefix of another. InMemoryStore compares namespaces element-wise and is not affected.

Three distinct cases were possible:

Sibling namespaces. A read scoped to ("foo",) also returned items under ("foobar",) and ("foo2",).
Unescaped pattern metacharacters. _ and % are legal namespace labels — only . is rejected — but were interpolated into the match pattern unescaped, so ("user_1",) also matched ("userX1",).
Suffix conditions. list_namespaces(suffix=("alice",)) also matched the sibling leaf users.malice.

This is not SQL injection. Values were passed as bound parameters and never interpolated into statement text; the bound value was itself a LIKE pattern whose metacharacters were not neutralized.

Impact

Confidentiality: disclosure of stored items belonging to namespaces outside the caller's intended scope, where namespaces are used as a tenant or user boundary.
No integrity or availability impact. get, put, and delete compare namespaces with = and were never affected; the issue is limited to read paths.

Patches / mitigation

Prefix scoping now matches the namespace exactly or requires the . separator before any remainder, pattern metacharacters in labels are escaped, and list_namespaces uses segment-aware matching for both prefix and suffix conditions.

On SQLite, the descendant match moved from LIKE to GLOB. LIKE is case-insensitive for ASCII in SQLite, so scoped reads previously matched namespaces differing only in case, while get/put/delete treated them as distinct. Search now agrees with them.

Upgrade to langgraph-checkpoint-postgres 3.1.1 or langgraph-checkpoint-sqlite 3.1.1.

Compatibility

* in a list_namespaces match path now spans exactly one namespace segment. This restores the documented behavior — NamespacePath documents ("cache", "*", "v1") as "any cache category with v1 version" — and matches InMemoryStore. Multi-segment matching was an artifact of translating * into a SQL % wildcard, the same mechanism responsible for this issue, and could not be preserved while fixing it.

Callers relying on the previous behavior can express "match at any depth" by combining both match conditions, which are ANDed:

list_namespaces(prefix=["uid"], suffix=["alice"])

Applications whose namespace labels cannot be prefixes of one another see no behavioral change.

Operational guidance

Prefer fixed-length namespace labels such as UUIDs, so no label can be a prefix of another.
Where labels are user-supplied, validate them at the boundary rather than relying on scoping alone.

LangSmith / hosted deployments note

Unlike previous store advisories, this issue does reach hosted deployments. LangSmith deployments default to LANGGRAPH_STORE_BACKEND=python, which uses AsyncPostgresStore from checkpoint-postgres. Deployments configured with LANGGRAPH_STORE_BACKEND=grpc use a separate implementation that received an equivalent fix.

Affected versions


          1.0.0


          1.0.1


          1.0.10


          1.0.11


          1.0.2


          1.0.3


          1.0.4


          1.0.5


          1.0.6


          1.0.7


          1.0.8


          1.0.9

+ 36 more


            2.0.0


            2.0.1


            2.0.10


            2.0.11


            2.0.12


            2.0.13


            2.0.14


            2.0.15


            2.0.16


            2.0.17


            2.0.18


            2.0.19


            2.0.2


            2.0.20


            2.0.21


            2.0.22


            2.0.23


            2.0.24


            2.0.25


            2.0.3


            2.0.4


            2.0.5


            2.0.6


            2.0.7


            2.0.8


            2.0.9


            3.0.0


            3.0.1


            3.0.2


            3.0.3


            3.0.4


            3.0.5


            3.1.0


            3.1.0a1


            3.1.0a3


            3.1.0a4

Fixed in


          3.1.1

References

Updated Aug 10, 2026 · Source: OSV.dev

Aug 07, 2024

Activity

Reach

Details