Vulnerability-Lookup

RHSA-2026:26204

Vulnerability from csaf_opensuse - Published: 2026-06-16 12:18 - Updated: 2026-10-01 10:36

Summary

Red Hat Security Advisory: postgresql:18 security update

Severity

Important

Notes

Topic: An update for the postgresql:18 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-6472

A flaw was found in PostgreSQL CREATE TYPE handling for multirange types. The database failed to properly verify schema CREATE privileges during multirange type creation. An authenticated database user could exploit this issue to hijack queries that rely on search_path resolution for user-defined or extension-defined types, potentially causing execution of arbitrary SQL functions within the affected database context.

5.4 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE-862 - Missing Authorization

Affected products

Fixed 199 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-0:1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-0:1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-0:1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-0:1.5.3-1.module+el9.8.0+23739+1c42644c.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-0:1.5.3-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debuginfo-0:1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debuginfo-0:1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debuginfo-0:1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debuginfo-0:1.5.3-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debugsource-0:1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debugsource-0:1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debugsource-0:1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pg_repack-debugsource-0:1.5.3-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-0:18.0-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-0:18.0-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-0:18.0-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-0:18.0-1.module+el9.8.0+23739+1c42644c.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-0:18.0-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debuginfo-0:18.0-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debuginfo-0:18.0-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debuginfo-0:18.0-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debuginfo-0:18.0-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debugsource-0:18.0-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debugsource-0:18.0-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debugsource-0:18.0-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgaudit-debugsource-0:18.0-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-0:0.8.1-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-0:0.8.1-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-0:0.8.1-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-0:0.8.1-1.module+el9.8.0+23739+1c42644c.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-0:0.8.1-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debuginfo-0:0.8.1-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debuginfo-0:0.8.1-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debuginfo-0:0.8.1-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debuginfo-0:0.8.1-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debugsource-0:0.8.1-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debugsource-0:0.8.1-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debugsource-0:0.8.1-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:pgvector-debugsource-0:0.8.1-1.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-0:3.6.1-2.module+el9.8.0+23739+1c42644c.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-client-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debugsource-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debugsource-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debugsource-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-debugsource-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-docs-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-docs-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-docs-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-docs-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-upgrade-debuginfo-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-utils-0:3.6.1-2.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-utils-0:3.6.1-2.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-utils-0:3.6.1-2.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgis-utils-0:3.6.1-2.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debuginfo-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debuginfo-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debuginfo-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debuginfo-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debugsource-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debugsource-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debugsource-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgres-decoderbufs-debugsource-0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:18.4-2.module+el9.8.0+24359+da7fad50.src::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-static-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-static-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-static-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-static-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-rpm-macros-0:18.4-2.module+el9.8.0+24359+da7fad50.noarch::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.aarch64::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.ppc64le::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.s390x::postgresql:18	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:18.4-2.module+el9.8.0+24359+da7fad50.x86_64::postgresql:18	—	Vendor Fix fix Workaround

Threats

Impact Moderate

CVE-2026-6473

A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6474

A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the `timeofday()` function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing confidential information.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-134 - Use of Externally-Controlled Format String

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Moderate

CVE-2026-6475

A flaw was found in PostgreSQL. This vulnerability, related to symlink following in pg_basebackup (plain format) and pg_rewind, allows an origin superuser to overwrite local files. By exploiting this, an attacker could potentially hijack the operating system account. This attack has practical implications if specific actions are taken, such as moving files to a different virtual machine (VM) or snapshotting the VM, between the execution of these commands and the server's restart.

6.7 (Medium)


                
                  CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Moderate

CVE-2026-6476

A flaw was found in PostgreSQL. An attacker with `pg_create_subscription` rights can exploit a SQL injection vulnerability in the `pg_createsubscriber` utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when `pg_createsubscriber` is next run, leading to potential compromise of the database system.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6477

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.

8.4 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6478

A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier.

8.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE-385 - Covert Timing Channel

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6479

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL (Secure Sockets Layer) and GSS (Generic Security Service) negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AF_UNIX socket. If SSL and GSS are both disabled, the same denial of service can be achieved via a PostgreSQL TCP socket.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-606 - Unchecked Input for Loop Condition

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6575

A flaw was found in PostgreSQL. This buffer over-read vulnerability in the `pg_restore_attribute_stats()` function allows a table maintainer to infer memory values. By providing array values of unmatched length, a malicious table maintainer can cause query planning to read past the end of an array, leading to information disclosure.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Moderate

CVE-2026-6637

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as a 'refint' cascade primary key and allows user-controlled updates, a SQL injection can enable an attacker to execute arbitrary SQL commands as the database user performing the update.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Important

CVE-2026-6638

A flaw was found in PostgreSQL. This SQL injection vulnerability exists within the logical replication feature, specifically when using the ALTER SUBSCRIPTION ... REFRESH PUBLICATION command. A malicious subscriber table creator can exploit this flaw to execute arbitrary SQL commands with the elevated privileges of the subscription's publication-side credentials. The attack is triggered when the REFRESH PUBLICATION command is next executed.

3.7 (Low)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Affected products

Fixed 199 products, the same list as for CVE-2026-6472

Threats

Impact Moderate

References

62 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:26204	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477439	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477442	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477447	external
https://bugzilla.redhat.com/show_bug.cgi?id=2477448	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-6472	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477436	external
https://www.cve.org/CVERecord?id=CVE-2026-6472	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6472	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6473	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477448	external
https://www.cve.org/CVERecord?id=CVE-2026-6473	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6473	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6474	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477441	external
https://www.cve.org/CVERecord?id=CVE-2026-6474	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6474	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6475	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477439	external
https://www.cve.org/CVERecord?id=CVE-2026-6475	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6475	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6476	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477437	external
https://www.cve.org/CVERecord?id=CVE-2026-6476	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6476	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6477	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477442	external
https://www.cve.org/CVERecord?id=CVE-2026-6477	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6477	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6478	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477447	external
https://www.cve.org/CVERecord?id=CVE-2026-6478	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6478	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6479	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477445	external
https://www.cve.org/CVERecord?id=CVE-2026-6479	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6479	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6575	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477440	external
https://www.cve.org/CVERecord?id=CVE-2026-6575	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6575	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6637	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477443	external
https://www.cve.org/CVERecord?id=CVE-2026-6637	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6637	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6638	self
https://bugzilla.redhat.com/show_bug.cgi?id=2477446	external
https://www.cve.org/CVERecord?id=CVE-2026-6638	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6638	external
https://www.postgresql.org/support/security/CVE-2…	external

JSON

To clipboard

Loading 1.3 MB of JSON…

CVE-2026-6472 (GCVE-0-2026-6472)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-14 13:43

Title

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

Summary

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

5.4 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 13:43 UTC

CWE

CWE-862 - Missing Authorization

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

Credits

The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6472",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T13:43:42.467820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T13:43:48.103Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        },
        {
          "lang": "en",
          "value": "victim query finds non-pg_catalog types via search_path"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types.  That is to say, the victim will execute arbitrary SQL functions of the attacker\u0027s choice.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:02.086Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6472/"
        }
      ],
      "title": "PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6472",
    "datePublished": "2026-05-14T13:00:02.086Z",
    "dateReserved": "2026-04-17T00:23:44.190Z",
    "dateUpdated": "2026-05-14T13:43:48.103Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6473 (GCVE-0-2026-6473)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-08-25 12:05

Title

PostgreSQL server undersizes allocations, via integer wraparound

Summary

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

PostgreSQL redhat root Scorecard

References

38 references

URL	Tags
https://www.postgresql.org/support/security/CVE-2…
https://access.redhat.com/security/cve/CVE-2026-6473	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2477448	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:49521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27718	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27743	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27742	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27738	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28999	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28208	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26181	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44420	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34362	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34363	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29815	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32994	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35880	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34043	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42555	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26561	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33497	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29953	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33441	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29904	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29212	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28037	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26203	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26204	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27741	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44568	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22878	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT

Impacted products

47 products

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:18.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:16.14-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:16.14-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:9.2.24-9.el7_9.6 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152259.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:13.23-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260530205218.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152256.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152253.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605131007.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605125734.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:13.23-3.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605124405.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 9020020260625101129.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260612132455.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_4.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260616071806.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260612084605.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:13.23-1.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260622062902.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Ansible Automation Platform 2.2	Unaffected: 1784804630 , < * (rpm) cpe:/a:redhat:ansible_portal:2.2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 18.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Red Hat Hardened Images	cpe:/a:redhat:hummingbird:1

Credits

The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6473",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:15.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:18.4-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.2.24-9.el7_9.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152259.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260530205218.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152256.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152253.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605131007.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:18",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605125734.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-3.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605124405.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9020020260625101129.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260612132455.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260616071806.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260612084605.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_6.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260622062902.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2.2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Red Hat Ansible Automation Platform 2.2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784804630",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "18.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784795076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql-jdbc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql17",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-14T13:00:09.446Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in PostgreSQL. An integer overflow in multiple server features allows an unprivileged database user to cause an undersized memory allocation that leads to an out-of-bounds write. This issue allows an attacker to execute arbitrary code as the operating system user running the database or, in applications that pass gigabyte-scale user inputs to the relevant database functions, to cause a segmentation fault, resulting in a denial of service."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:44.149Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-6473"
          },
          {
            "name": "RHBZ#2477448",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477448"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6473.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27718"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27743"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27742"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27738"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28999"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28208"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26181"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44420"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34362"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34363"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29815"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32994"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35880"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34043"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42555"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26561"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33497"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29953"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26524"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29904"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32983"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29212"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28037"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26203"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26204"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27741"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44568"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22878"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44481"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:58981"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:49521: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27718: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27743: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27742: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27738: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28999: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28208: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26181: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28143: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44420: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34362: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34363: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29815: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32994: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35880: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34043: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42555: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26561: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33497: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29953: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33441: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26524: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29904: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26525: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29212: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28037: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26203: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26204: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27741: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44568: Red Hat Ansible Automation Platform 2.2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22878: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-14T14:01:48.197Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-14T13:00:09.446Z",
            "value": "Made public."
          }
        ],
        "title": "postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, validate the length of data and the size of objects on all client APIs and web interfaces. Also, block, drop, or truncate oversized string, array, or binary objects before they are passed into backend SQL queries."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds.  This may execute arbitrary code as the operating system user running the database.  In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:09.446Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6473/"
        }
      ],
      "title": "PostgreSQL server undersizes allocations, via integer wraparound"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6473",
    "datePublished": "2026-05-14T13:00:09.446Z",
    "dateReserved": "2026-04-17T00:27:22.802Z",
    "dateUpdated": "2026-08-25T12:05:44.149Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6474 (GCVE-0-2026-6474)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-14 15:30

Title

PostgreSQL timeofday() can disclose portions of server memory

Summary

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 15:30 UTC

CWE

CWE-134 - Use of Externally-Controlled Format String

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

Credits

The PostgreSQL project thanks Xint Code for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:30:17.967244Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:30:37.425Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Xint Code for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-134",
              "description": "Use of Externally-Controlled Format String",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:10.254Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6474/"
        }
      ],
      "title": "PostgreSQL timeofday() can disclose portions of server memory"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6474",
    "datePublished": "2026-05-14T13:00:10.254Z",
    "dateReserved": "2026-04-17T00:36:25.451Z",
    "dateUpdated": "2026-05-14T15:30:37.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6475 (GCVE-0-2026-6475)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-15 03:56

Title

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Summary

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-61 - UNIX Symbolic Link (Symlink) Following

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

Credits

The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu (pkugenuine(at)gmail(dot)com), Guannan Wang (wgnbuaa(at)gmail(dot)com), and Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:16.367Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu (pkugenuine(at)gmail(dot)com), Guannan Wang (wgnbuaa(at)gmail(dot)com), and Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account.  It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries.  Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-61",
              "description": "UNIX Symbolic Link (Symlink) Following",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:11.039Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6475/"
        }
      ],
      "title": "PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6475",
    "datePublished": "2026-05-14T13:00:11.039Z",
    "dateReserved": "2026-04-17T00:43:21.782Z",
    "dateUpdated": "2026-05-15T03:56:16.367Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6476 (GCVE-0-2026-6476)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-15 03:56

Title

PostgreSQL pg_createsubscriber allows SQL injection via subscription name

Summary

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm)

Credits

The PostgreSQL project thanks Yu Kunpeng for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:17.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has pg_create_subscription rights"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Yu Kunpeng for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser.  The attack takes effect when pg_createsubscriber next runs.  Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.  Versions before PostgreSQL 17 are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:11.865Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6476/"
        }
      ],
      "title": "PostgreSQL pg_createsubscriber allows SQL injection via subscription name"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6476",
    "datePublished": "2026-05-14T13:00:11.865Z",
    "dateReserved": "2026-04-17T00:43:55.119Z",
    "dateUpdated": "2026-05-15T03:56:17.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6477 (GCVE-0-2026-6477)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-08-25 12:05

Title

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Summary

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8.4 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-242 - Use of Inherently Dangerous Function
CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Assigner

PostgreSQL redhat root Scorecard

References

46 references

URL	Tags
https://www.postgresql.org/support/security/CVE-2…
https://access.redhat.com/security/cve/CVE-2026-6477	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2477442	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:49521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50863	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27718	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44391	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27743	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27742	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27738	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28999	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28208	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26181	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44420	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34362	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34363	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:47090	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29815	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32994	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35880	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34043	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42555	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26561	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49908	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33497	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29953	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:49909	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33441	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29904	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:50779	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29212	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44308	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28037	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26203	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26204	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27741	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:54760	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21182	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22878	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT

Impacted products

54 products

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:18.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:16.14-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:16.14-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:16.14-0.el10_0.1 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:9.2.24-9.el7_9.6 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152259.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:13.23-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260530205218.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152256.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152253.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 0:13.23-1.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 0:13.23-1.el8_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605131007.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605125734.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:13.23-3.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605124405.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 9020020260625101129.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_2.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260612132455.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_4.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260616071806.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_4.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260612084605.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:13.23-1.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260622062902.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:13.23-1.el9_6.1 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Discovery 2	Unaffected: 1786638573 , < * (rpm) cpe:/a:redhat:discovery:2::el9
Red Hat	Red Hat Hardened Images	Unaffected: 17.10-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 18.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Credits

The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6477",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:18.668Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:18.4-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-0.el10_0.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.2.24-9.el7_9.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152259.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260530205218.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152256.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152253.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605131007.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:18",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605125734.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-3.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605124405.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-3.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9020020260625101129.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_2.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260612132455.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260616071806.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260612084605.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_6.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260622062902.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_6.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:discovery:2::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "discovery/discovery-server-rhel9",
            "product": "Red Hat Discovery 2",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1786638573",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql17-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "17.10-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "18.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784795076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql-jdbc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-14T13:00:12.497Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client\u0027s stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.4,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-120",
                "description": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:44.549Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-6477"
          },
          {
            "name": "RHBZ#2477442",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6477.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50863"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27718"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44391"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27743"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27742"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27738"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28999"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28208"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26181"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44420"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34362"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34363"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:47090"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29815"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32994"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35880"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34043"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42555"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26561"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49908"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33497"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29953"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49909"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26524"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29904"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:50779"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32983"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29212"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44308"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28037"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26203"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26204"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27741"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:54760"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21182"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22878"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44481"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:58981"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:49521: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50863: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27718: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44391: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27743: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27742: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27738: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28999: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28208: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26181: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28143: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44420: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34362: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34363: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:47090: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29815: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32994: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35880: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34043: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42555: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26561: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49908: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33497: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29953: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:49909: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33441: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26524: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29904: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:50779: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26525: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29212: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44308: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28037: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26203: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26204: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27741: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:54760: Red Hat Discovery 2"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21182: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22878: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-14T14:01:31.087Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-14T13:00:12.497Z",
            "value": "Made public."
          }
        ],
        "title": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory",
        "workarounds": [
          {
            "lang": "en",
            "value": "Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response.  Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size.  Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-242",
              "description": "Use of Inherently Dangerous Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:12.497Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6477/"
        }
      ],
      "title": "PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory",
      "workarounds": [
        {
          "lang": "en",
          "value": "use PQexecPrepared(), not PQfn(..., result_is_int=0, ...) or its lo_* wrappers"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6477",
    "datePublished": "2026-05-14T13:00:12.497Z",
    "dateReserved": "2026-04-17T00:44:19.965Z",
    "dateUpdated": "2026-08-25T12:05:44.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6478 (GCVE-0-2026-6478)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-08-25 12:05

Title

PostgreSQL discloses MD5-hashed passwords via covert timing channel

Summary

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 15:32 UTC

CWE

CWE-385 - Covert Timing Channel

Assigner

PostgreSQL redhat root Scorecard

References

38 references

URL	Tags
https://www.postgresql.org/support/security/CVE-2…
https://access.redhat.com/security/cve/CVE-2026-6478	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2477447	issue-trackingx_refsource_REDHAT
https://security.access.redhat.com/data/csaf/v2/v…	x_sadp-csaf-vex
https://access.redhat.com/errata/RHSA-2026:49521	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27718	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27743	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27742	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27738	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28999	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28208	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26181	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28143	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44420	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34362	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34363	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29815	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32994	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:35880	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:34043	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:42555	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26561	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33497	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29953	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:33441	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26524	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29904	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:32983	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26525	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:29212	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:28037	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26203	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:26204	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:27741	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:21182	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:22878	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:44481	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2026:58981	vendor-advisoryx_refsource_REDHAT

Impacted products

47 products

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:18.4-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10	Unaffected: 0:16.14-1.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.2
Red Hat	Red Hat Enterprise Linux 10.0 Extended Update Support	Unaffected: 0:16.14-1.el10_0 , < * (rpm) cpe:/o:redhat:enterprise_linux_eus:10.0
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support	Unaffected: 0:9.2.24-9.el7_9.6 , < * (rpm) cpe:/o:redhat:rhel_els:7
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152259.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 0:13.23-2.el8_10 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260530205218.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152256.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020260605152253.489197e6 , < * (rpm) cpe:/a:redhat:enterprise_linux:8
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_aus:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260624104459.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 8040020260630100922.522a0ee4 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On	Unaffected: 0:13.23-1.el8_4.1 , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.4
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_aus:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260623094704.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On	Unaffected: 8060020260625065744.ad008a3a , < * (rpm) cpe:/a:redhat:rhel_eus_long_life:8.6
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_tus:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260615085052.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260626093604.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el8_8.1 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions	Unaffected: 8080020260709122729.63b34585 , < * (rpm) cpe:/a:redhat:rhel_e4s:8.8
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605131007.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605125734.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 0:13.23-3.el9_8 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 9080020260605124405.rhel9 , < * (rpm) cpe:/a:redhat:enterprise_linux:9
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_2.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions	Unaffected: 9020020260625101129.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.2
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260612132455.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 0:13.23-1.el9_4.2 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions	Unaffected: 9040020260616071806.rhel9 , < * (rpm) cpe:/a:redhat:rhel_e4s:9.4
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260612084605.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 0:13.23-1.el9_6.2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Enterprise Linux 9.6 Extended Update Support	Unaffected: 9060020260622062902.rhel9 , < * (rpm) cpe:/a:redhat:rhel_eus:9.6
Red Hat	Red Hat Hardened Images	Unaffected: 17.10-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Hardened Images	Unaffected: 18.4-0.1.hum1 , < * (rpm) cpe:/a:redhat:hummingbird:1
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1784795076 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Update Infrastructure 5	Unaffected: 1787241260 , < * (rpm) cpe:/a:redhat:rhui:5::el9
Red Hat	Red Hat Enterprise Linux 6	cpe:/o:redhat:enterprise_linux:6
Red Hat	Red Hat Enterprise Linux 8	cpe:/o:redhat:enterprise_linux:8
Red Hat	Self-service automation portal 2	cpe:/a:redhat:ansible_portal:2

Credits

The PostgreSQL project thanks Joe Conway for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6478",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:32:42.868340Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:33:03.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "affected": [
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:18.4-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:10.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux_eus:10.0"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql16",
            "product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:16.14-1.el10_0",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:rhel_els:7"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:9.2.24-9.el7_9.6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152259.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-2.el8_10",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260530205218.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152256.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8100020260605152253.489197e6",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260624104459.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8040020260630100922.522a0ee4",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.4"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_4.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_aus:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260623094704.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus_long_life:8.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8060020260625065744.ad008a3a",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_tus:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260615085052.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:12",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260626093604.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "libpq",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el8_8.1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:8.8"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:13",
            "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "8080020260709122729.63b34585",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605131007.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:18",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605125734.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-3.el9_8",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:enterprise_linux:9"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9080020260605124405.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_2.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.2"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9020020260625101129.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260612132455.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_4.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_e4s:9.4"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9040020260616071806.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:16",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260612084605.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "0:13.23-1.el9_6.2",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:rhel_eus:9.6"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql:15",
            "product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "9060020260622062902.rhel9",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql17-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "17.10-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:hummingbird:1"
            ],
            "defaultStatus": "affected",
            "packageName": "postgresql18-main",
            "product": "Red Hat Hardened Images",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "18.4-0.1.hum1",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1784795076",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://catalog.redhat.com/software/containers/",
            "cpes": [
              "cpe:/a:redhat:rhui:5::el9"
            ],
            "defaultStatus": "affected",
            "packageName": "rhui5/rhua-tp-rhel9",
            "product": "Red Hat Update Infrastructure 5",
            "vendor": "Red Hat",
            "versions": [
              {
                "lessThan": "*",
                "status": "unaffected",
                "version": "1787241260",
                "versionType": "rpm"
              }
            ]
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:6"
            ],
            "defaultStatus": "unknown",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 6",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/o:redhat:enterprise_linux:8"
            ],
            "defaultStatus": "unaffected",
            "packageName": "postgresql-jdbc",
            "product": "Red Hat Enterprise Linux 8",
            "vendor": "Red Hat"
          },
          {
            "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
            "cpes": [
              "cpe:/a:redhat:ansible_portal:2"
            ],
            "defaultStatus": "affected",
            "packageName": "ansible-automation-platform/bootc-automation-portal-rhel9",
            "product": "Self-service automation portal 2",
            "vendor": "Red Hat"
          }
        ],
        "datePublic": "2026-05-14T13:00:13.174Z",
        "descriptions": [
          {
            "lang": "en",
            "value": "A flaw was found in PostgreSQL. This vulnerability, a covert timing channel, exists in the comparison of MD5-hashed passwords during authentication. A remote attacker could exploit this to recover user credentials, gaining unauthorized access to the database. This issue specifically impacts databases that retain MD5-hashed passwords from upgrades of PostgreSQL 13 or earlier."
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "namespace": "https://access.redhat.com/security/updates/classification/",
                "value": "Important"
              },
              "type": "Red Hat severity rating"
            }
          },
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 8.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
              "version": "3.1"
            },
            "format": "CVSS"
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-385",
                "description": "Covert Timing Channel",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-25T12:05:38.739Z",
          "orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
          "shortName": "redhat-SADP"
        },
        "references": [
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2026-6478"
          },
          {
            "name": "RHBZ#2477447",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477447"
          },
          {
            "tags": [
              "x_sadp-csaf-vex"
            ],
            "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6478.json"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:49521"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27718"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27743"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27742"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27738"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28999"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28208"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26181"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28143"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44420"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34362"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34363"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29815"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32994"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:35880"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:34043"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:42555"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26561"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33497"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29953"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:33441"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26524"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29904"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:32983"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26525"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:29212"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:28037"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26203"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:26204"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:27741"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:21182"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:22878"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:44481"
          },
          {
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2026:58981"
          }
        ],
        "solutions": [
          {
            "lang": "en",
            "value": "RHSA-2026:49521: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27718: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27743: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27742: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27738: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28999: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28208: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26181: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28143: Red Hat Enterprise Linux AppStream (v. 8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44420: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34362: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34363: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29815: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32994: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:35880: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:34043: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:42555: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26561: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33497: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29953: Red Hat Enterprise Linux AppStream E4S (v.9.2)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:33441: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26524: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29904: Red Hat Enterprise Linux AppStream E4S (v.9.4)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:32983: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26525: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:29212: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:28037: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26203: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:26204: Red Hat Enterprise Linux AppStream (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:27741: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:21182: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:22878: Red Hat Hardened Images"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:44481: Red Hat Update Infrastructure 5"
          },
          {
            "lang": "en",
            "value": "RHSA-2026:58981: Red Hat Update Infrastructure 5"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-05-14T14:01:45.568Z",
            "value": "Reported to Red Hat."
          },
          {
            "lang": "en",
            "time": "2026-05-14T13:00:13.174Z",
            "value": "Made public."
          }
        ],
        "title": "postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison",
        "workarounds": [
          {
            "lang": "en",
            "value": "To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as `scram-sha-256`. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user\u0027s password: `ALTER USER username WITH PASSWORD \u0027new_password\u0027;` This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details."
          }
        ],
        "x_adpType": "supplier",
        "x_generator": {
          "engine": "sadp-cli 1.0.0"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "victim user has a usable MD5 password"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Joe Conway for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "Covert Timing Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:13.174Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6478/"
        }
      ],
      "title": "PostgreSQL discloses MD5-hashed passwords via covert timing channel",
      "workarounds": [
        {
          "lang": "en",
          "value": "reset password with password_encryption=scram-sha-256"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6478",
    "datePublished": "2026-05-14T13:00:13.174Z",
    "dateReserved": "2026-04-17T00:44:57.549Z",
    "dateUpdated": "2026-08-25T12:05:38.739Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6479 (GCVE-0-2026-6479)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-14 15:26

Title

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

Summary

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 15:26 UTC

CWE

CWE-674 - Uncontrolled Recursion

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

Credits

The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6479",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:26:13.223741Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:26:20.166Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-674",
              "description": "Uncontrolled Recursion",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:13.859Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6479/"
        }
      ],
      "title": "PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion",
      "workarounds": [
        {
          "lang": "en",
          "value": "enable SSL and/or GSS; disable unix_socket_directories"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6479",
    "datePublished": "2026-05-14T13:00:13.859Z",
    "dateReserved": "2026-04-17T00:45:37.869Z",
    "dateUpdated": "2026-05-14T15:26:20.166Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6575 (GCVE-0-2026-6575)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-14 15:26

Title

PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

Summary

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 15:26 UTC

CWE

CWE-126 - Buffer Over-read

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm)

Credits

The PostgreSQL project thanks Jeroen Gui for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6575",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T15:26:33.401571Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-14T15:26:40.715Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema) or permission to maintain an existing table"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Jeroen Gui for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.  This allows a table maintainer to infer memory values past that array end.  Within major version 18, minor versions before PostgreSQL 18.4 are affected.  Versions before PostgreSQL 18 are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-126",
              "description": "Buffer Over-read",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:14.542Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6575/"
        }
      ],
      "title": "PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6575",
    "datePublished": "2026-05-14T13:00:14.542Z",
    "dateReserved": "2026-04-19T00:06:35.060Z",
    "dateUpdated": "2026-05-14T15:26:40.715Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-6637 (GCVE-0-2026-6637)

Vulnerability from cvelistv5 – Published: 2026-05-14 13:00 – Updated: 2026-05-15 03:56

Title

PostgreSQL refint allows stack buffer overflow and SQL injection

Summary

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-14 00:00 UTC

CWE

CWE-121 - Stack-based Buffer Overflow
CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

PostgreSQL redhat root Scorecard

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

Credits

The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-6637",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-14T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-15T03:56:19.781Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "superuser previously installed the refint extension"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack buffer overflow in PostgreSQL module \"refint\" allows an unprivileged database user to execute arbitrary code as the operating system user running the database.  A distinct attack is possible if the application declares a user-controlled column as a \"refint\" cascade primary key and facilitates user-controlled updates to that column.  In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-89",
              "description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-14T13:00:15.223Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-6637/"
        }
      ],
      "title": "PostgreSQL refint allows stack buffer overflow and SQL injection"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-6637",
    "datePublished": "2026-05-14T13:00:15.223Z",
    "dateReserved": "2026-04-19T19:58:20.340Z",
    "dateUpdated": "2026-05-15T03:56:19.781Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:26204

CVE-2026-6472 (GCVE-0-2026-6472)

CVE-2026-6473 (GCVE-0-2026-6473)

CVE-2026-6474 (GCVE-0-2026-6474)

CVE-2026-6475 (GCVE-0-2026-6475)

CVE-2026-6476 (GCVE-0-2026-6476)

CVE-2026-6477 (GCVE-0-2026-6477)

CVE-2026-6478 (GCVE-0-2026-6478)

CVE-2026-6479 (GCVE-0-2026-6479)

CVE-2026-6575 (GCVE-0-2026-6575)

CVE-2026-6637 (GCVE-0-2026-6637)

Tags

Sightings

Nomenclature

Related by attack behaviour