Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1530
Vulnerability from certfr_avis - Published: 2026-11-13 - Updated: 2026-11-13
De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
L'éditeur mentionne que la version 14 de ProstgreSQL a atteint sa fin de vie et ne recevra plus de mis à jour. Il est donc recommandé de migrer vers une version supportée.
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PostgreSQL | PostgreSQL | PostgreSQL versions antérieures à 14.25 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 17.x antérieures à 17.12 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 18.x antérieures à 18.7 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 19 x antérieures à 19 RC 2 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 15.x antérieures à 15.20 | ||
| PostgreSQL | PostgreSQL | PostgreSQL versions 16.x antérieures à 16.16 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PostgreSQL versions ant\u00e9rieures \u00e0 14.25",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 17.x ant\u00e9rieures \u00e0 17.12",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 18.x ant\u00e9rieures \u00e0 18.7",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 19 x ant\u00e9rieures \u00e0 19 RC 2",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 15.x ant\u00e9rieures \u00e0 15.20",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 16.x ant\u00e9rieures \u00e0 16.16",
"product": {
"name": "PostgreSQL",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
}
],
"affected_systems_content": "L\u0027\u00e9diteur mentionne que la version 14 de ProstgreSQL a atteint sa fin de vie et ne recevra plus de mis \u00e0 jour. Il est donc recommand\u00e9 de migrer vers une version support\u00e9e.",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-16240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16240"
},
{
"name": "CVE-2026-6460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6460"
},
{
"name": "CVE-2026-120147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120147"
},
{
"name": "CVE-2026-116327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116327"
},
{
"name": "CVE-2026-116335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116335"
},
{
"name": "CVE-2026-116328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116328"
},
{
"name": "CVE-2026-120144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120144"
},
{
"name": "CVE-2026-116333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116333"
},
{
"name": "CVE-2026-120142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120142"
},
{
"name": "CVE-2026-116314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116314"
},
{
"name": "CVE-2026-116315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116315"
},
{
"name": "CVE-2026-120143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120143"
},
{
"name": "CVE-2026-116320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116320"
},
{
"name": "CVE-2026-116319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116319"
},
{
"name": "CVE-2026-116304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116304"
},
{
"name": "CVE-2026-116316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116316"
},
{
"name": "CVE-2026-120151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120151"
},
{
"name": "CVE-2026-116310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116310"
},
{
"name": "CVE-2026-116336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116336"
},
{
"name": "CVE-2026-120152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120152"
},
{
"name": "CVE-2026-116313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116313"
},
{
"name": "CVE-2026-120153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120153"
},
{
"name": "CVE-2026-120154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120154"
},
{
"name": "CVE-2026-14661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14661"
},
{
"name": "CVE-2026-6467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6467"
},
{
"name": "CVE-2026-116309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116309"
},
{
"name": "CVE-2026-116306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116306"
},
{
"name": "CVE-2026-116311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116311"
},
{
"name": "CVE-2026-116330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116330"
},
{
"name": "CVE-2026-116321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116321"
},
{
"name": "CVE-2026-116329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116329"
},
{
"name": "CVE-2026-120148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120148"
},
{
"name": "CVE-2026-120146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120146"
},
{
"name": "CVE-2026-116318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116318"
},
{
"name": "CVE-2026-116331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116331"
},
{
"name": "CVE-2026-120145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120145"
},
{
"name": "CVE-2026-116307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116307"
},
{
"name": "CVE-2026-120149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120149"
},
{
"name": "CVE-2026-116317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116317"
},
{
"name": "CVE-2026-116303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116303"
},
{
"name": "CVE-2026-116325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116325"
},
{
"name": "CVE-2026-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6464"
},
{
"name": "CVE-2026-116332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116332"
},
{
"name": "CVE-2026-116312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116312"
},
{
"name": "CVE-2026-120139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120139"
},
{
"name": "CVE-2026-116308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116308"
},
{
"name": "CVE-2026-116322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116322"
},
{
"name": "CVE-2026-16237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16237"
},
{
"name": "CVE-2026-116326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116326"
},
{
"name": "CVE-2026-120150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120150"
},
{
"name": "CVE-2026-116323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116323"
},
{
"name": "CVE-2026-18447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18447"
},
{
"name": "CVE-2026-120141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120141"
}
],
"initial_release_date": "2026-11-13T00:00:00",
"last_revision_date": "2026-11-13T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1530",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-11-13T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PostgreSQL. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PostgreSQL",
"vendor_advisories": [
{
"published_at": "2026-11-12",
"title": "Bulletin de s\u00e9curit\u00e9 PostgreSQL postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442",
"url": "https://www.postgresql.org/about/news/postgresql-187-1712-1616-1520-1425-and-19-rc-2-released-3442/"
}
]
}
CVE-2026-120149 (GCVE-0-2026-120149)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL FDW batch-insert mismatch executes arbitrary code
Summary
Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:44.806Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION postgres_fdw\"; attacker has local permission to create objects (temporary objects or non-temporary objects in at least one schema); attacker has remote-server permission to create non-temporary objects in at least one schema."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Sumedh Pathak and Sven Klemm for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:26.749Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120149/"
}
],
"title": "PostgreSQL FDW batch-insert mismatch executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120149",
"datePublished": "2026-11-12T14:15:26.749Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:44.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120150 (GCVE-0-2026-120150)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-14 04:57
VLAI
EPSS
VEX
Title
PostgreSQL expanded-record domain-check use-after-free executes arbitrary code
Summary
Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-13 00:00 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-14T04:57:40.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:27.323Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120150/"
}
],
"title": "PostgreSQL expanded-record domain-check use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120150",
"datePublished": "2026-11-12T14:15:27.323Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-14T04:57:40.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120151 (GCVE-0-2026-120151)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL plpgsql record-field type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:40.366Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable\u0027s row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:27.877Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120151/"
}
],
"title": "PostgreSQL plpgsql record-field type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120151",
"datePublished": "2026-11-12T14:15:27.877Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:40.366Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120152 (GCVE-0-2026-120152)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:43
VLAI
EPSS
VEX
Title
PostgreSQL pg_show_all_settings() use-after-free discloses memory
Summary
Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:11 UTC
CWE
- CWE-416 - Use After Free
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:11:31.172233Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:43:08.510Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:28.444Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120152/"
}
],
"title": "PostgreSQL pg_show_all_settings() use-after-free discloses memory",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120152",
"datePublished": "2026-11-12T14:15:28.444Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-12T21:43:08.510Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120153 (GCVE-0-2026-120153)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL extension-script substitutions allow SQL injection through object names
Summary
SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:37.985Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has database-level CREATE privilege, and administrator has installed the files of a vulnerable non-bundled extension"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program, Sven Klemm, and Aaron chen for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:29.010Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120153/"
}
],
"title": "PostgreSQL extension-script substitutions allow SQL injection through object names",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120153",
"datePublished": "2026-11-12T14:15:29.010Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-13T05:02:37.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-120154 (GCVE-0-2026-120154)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies
Summary
Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-120154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:35.332140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:35.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT, UPDATE, and applicable SELECT privileges on a table with a row security policy"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, Nicholas Carlini, Joao Detomini, Josef \u0160im\u00e1nek, and Qing Xu for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:29.579Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120154/"
}
],
"title": "PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-120154",
"datePublished": "2026-11-12T14:15:29.579Z",
"dateReserved": "2026-10-30T22:45:08.383Z",
"dateUpdated": "2026-11-12T21:42:35.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14661 (GCVE-0-2026-14661)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL dblink and subscriptions can append to arbitrary files
Summary
External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-73 - External Control of File Name or Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14661",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:28.300290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:18.453Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION dblink\"."
},
{
"lang": "en",
"value": "Superuser previously granted pg_create_subscription to non-superuser roles."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user\u0027s choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "External Control of File Name or Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:30.140Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14661/"
}
],
"title": "PostgreSQL dblink and subscriptions can append to arbitrary files",
"workarounds": [
{
"lang": "en",
"value": "Revoke public EXECUTE permission on dblink functions"
},
{
"lang": "en",
"value": "Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges"
}
],
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14661",
"datePublished": "2026-11-12T14:15:30.140Z",
"dateReserved": "2026-07-03T20:28:07.149Z",
"dateUpdated": "2026-11-12T21:42:18.453Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16237 (GCVE-0-2026-16237)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:42
VLAI
EPSS
VEX
Title
PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition
Summary
Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-424 - Improper Protection of Alternate Path
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16237",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:19.107281Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:42:02.923Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT and UPDATE privileges on an auto-updatable view but lacks one of those on its base table"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view\u0027s base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view\u0027s WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-424",
"description": "Improper Protection of Alternate Path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:30.710Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16237/"
}
],
"title": "PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16237",
"datePublished": "2026-11-12T14:15:30.710Z",
"dateReserved": "2026-07-20T01:55:06.428Z",
"dateUpdated": "2026-11-12T21:42:02.923Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16240 (GCVE-0-2026-16240)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-12 21:41
VLAI
EPSS
VEX
Title
PostgreSQL pg_basebackup can use backup manifest content as a format string
Summary
Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 21:10 UTC
CWE
- CWE-134 - Use of Externally-Controlled Format String
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16240",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T21:10:07.723348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T21:41:47.325Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has compromised the server being backed up; attacker has a separate way to retrieve the improperly-read bytes from the host running pg_basebackup; victim runs a backup without starting the server from that backup"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Eisentraut for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker\u0027s server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-134",
"description": "Use of Externally-Controlled Format String",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:31.280Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16240/"
}
],
"title": "PostgreSQL pg_basebackup can use backup manifest content as a format string",
"x_postgresql": {
"component": "client"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16240",
"datePublished": "2026-11-12T14:15:31.280Z",
"dateReserved": "2026-07-20T01:55:33.940Z",
"dateUpdated": "2026-11-12T21:41:47.325Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18447 (GCVE-0-2026-18447)
Vulnerability from cvelistv5 – Published: 2026-11-12 14:15 – Updated: 2026-11-13 05:02
VLAI
EPSS
VEX
Title
PostgreSQL output parameter type confusion executes arbitrary code
Summary
Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-12 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.7
(rpm)
Affected: 17 , < 17.12 (rpm) Affected: 16 , < 16.16 (rpm) Affected: 15 , < 15.20 (rpm) Affected: 0 , < 14.25 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-12T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-13T05:02:36.602Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-12T14:15:31.850Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-18447/"
}
],
"title": "PostgreSQL output parameter type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-18447",
"datePublished": "2026-11-12T14:15:31.850Z",
"dateReserved": "2026-07-31T02:56:08.443Z",
"dateUpdated": "2026-11-13T05:02:36.602Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…