{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
    }
  ],
  "id": "CVE-2026-6478",
  "lastModified": "2026-05-14T16:21:23.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-05-14T14:16:25.463",
  "references": [
    {
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "url": "https://www.postgresql.org/support/security/CVE-2026-6478/"
    }
  ],
  "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
  "vulnStatus": "Undergoing Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-385"
        }
      ],
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "type": "Secondary"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "PostgreSQL versions 18.x ant\u00e9rieures \u00e0 18.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL versions 15.x ant\u00e9rieures \u00e0 15.18",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL versions 14.x ant\u00e9rieures \u00e0 14.23",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL versions 16.x ant\u00e9rieures \u00e0 16.14",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    },
    {
      "description": "PostgreSQL versions 17.x ant\u00e9rieures \u00e0 17.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "PostgreSQL",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-6474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6474"
    },
    {
      "name": "CVE-2026-6472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6472"
    },
    {
      "name": "CVE-2026-6479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6479"
    },
    {
      "name": "CVE-2026-6575",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6575"
    },
    {
      "name": "CVE-2026-6637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6637"
    },
    {
      "name": "CVE-2026-6473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6473"
    },
    {
      "name": "CVE-2026-6638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6638"
    },
    {
      "name": "CVE-2026-6478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6478"
    },
    {
      "name": "CVE-2026-6475",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6475"
    },
    {
      "name": "CVE-2026-6477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
    },
    {
      "name": "CVE-2026-6476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6476"
    }
  ],
  "initial_release_date": "2026-05-15T00:00:00",
  "last_revision_date": "2026-05-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0595",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PostgreSQL. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans PostgreSQL",
  "vendor_advisories": [
    {
      "published_at": "2026-05-14",
      "title": "Bulletin de s\u00e9curit\u00e9 PostgreSQL postgresql-184-1710-1614-1518-and-1423-released-3297",
      "url": "https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/"
    }
  ]
}

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-6478.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "PostgreSQL discloses MD5-hashed passwords via covert timing channel",
    "tracking": {
      "current_release_date": "2026-05-16T01:03:55.000Z",
      "generator": {
        "date": "2026-05-16T07:10:14.971Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-6478",
      "initial_release_date": "2026-05-02T00:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-05-16T01:03:55.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 postgresql 0:16.12-1.azl3",
                "product": {
                  "name": "azl3 postgresql 0:16.12-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "postgresql"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 postgresql 0:16.12-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-6478",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "notes": [
        {
          "category": "general",
          "text": "PostgreSQL",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-6478.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-05-16T01:03:55.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 6.5,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "17084-1"
          ]
        }
      ],
      "title": "PostgreSQL discloses MD5-hashed passwords via covert timing channel"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-6478"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-385"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T14:16:25Z",
    "severity": "MODERATE"
  },
  "details": "Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.",
  "id": "GHSA-r6v6-v5r9-3ggh",
  "modified": "2026-05-14T15:31:58Z",
  "published": "2026-05-14T15:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6478"
    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/support/security/CVE-2026-6478"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}