Vulnerability-Lookup

RHSA-2026:69607

Vulnerability from csaf_redhat - Published: 2026-09-22 04:25 - Updated: 2026-11-05 16:49

Summary

Red Hat Security Advisory: postgresql security update

Severity

Important

Notes

Topic: An update for postgresql is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239) * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669) * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679) * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671) * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670) * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668) * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-6464

A flaw was found in PostgreSQL psql. During the `COPY FROM STDIN` operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation requires the attacker to control both the server and the data being copied, or to leverage a coincidental error while controlling only the data.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Affected products

Fixed 162 products

Product	Version	Remediation
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:13.23-6.el9_8.src	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-contrib-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-debugsource-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-docs-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plperl-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-plpython3-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-pltcl-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-devel-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-private-libs-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-server-devel-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-static-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-static-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-static-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-static-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-test-rpm-macros-0:13.23-6.el9_8.noarch	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.aarch64	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.ppc64le	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.s390x	—	Vendor Fix fix Workaround
Unresolved product id: CRB-9.8.0.Z.MAIN.EUS:postgresql-upgrade-devel-debuginfo-0:13.23-6.el9_8.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

CVE-2026-6471

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server.

7.2 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE-94 - Improper Control of Generation of Code

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14662

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could potentially allow an attacker to execute arbitrary code as the operating system user running the database.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787 - Out-of-bounds Write

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14664

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the operating system user running the database.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14668

A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory.

8.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CWE-843 - Access of Resource Using Incompatible Type

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14669

A heap buffer overflow flaw was found in the PostgreSQL to_char(timestamptz) function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14670

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the plperl component when returning a tied hash. This allows a function owner to execute arbitrary code as the operating system user running the database by providing a specially crafted function body. This could lead to unauthorized access and control over the database system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-805 - Buffer Access with Incorrect Length Value

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14671

A flaw was found in PostgreSQL. A type confusion vulnerability in the 'refint' module allows an object creator to execute arbitrary code as the operating system user running the database. This could lead to a complete compromise of the database server.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-843 - Access of Resource Using Incompatible Type

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14677

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system user running the database.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14679

A flaw was found in PostgreSQL. An object creator can exploit a stack buffer overflow vulnerability within the argument name matching component. By manipulating the OUT parameter count, an attacker can write limited arbitrary bytes (0x0 and 0x1) to server memory, which may lead to unknown impacts.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CWE-121 - Stack-based Buffer Overflow

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-14680

A type confusion vulnerability in PostgreSQL allows any user to execute arbitrary code as the database's operating system user by calling functions with mishandled "internal" data type arguments.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-843 - Access of Resource Using Incompatible Type

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-15742

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the `levenshtein()` or `levenshtein_less_equal()` SQL functions. This allows the user to execute arbitrary code as the operating system user running the database, potentially leading to full system compromise.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 - Integer Overflow or Wraparound

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-16239

A flaw was found in PostgreSQL. This vulnerability, caused by type confusion in the 'portal'/cursor lifecycle, allows a user to execute arbitrary code as the operating system user running the database. This can occur by re-creating a cursor or other portal with different types. Successful exploitation could lead to a complete compromise of the database system.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-843 - Access of Resource Using Incompatible Type

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-18408

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pg_dump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim processes this manipulated dump, the injected code executes with the privileges of the operating system account running the psql client.

8.4 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

CVE-2026-19385

A flaw was found in PostgreSQL pg_dump. A heap buffer overflow vulnerability exists when processing long function transform lists. An authenticated object creator can exploit this by providing a specially crafted transform list. This allows the attacker to execute arbitrary code as the operating system user running pg_dump.

8.8 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-122 - Heap-based Buffer Overflow

Affected products

Fixed 162 products, the same list as for CVE-2026-6464

Threats

Impact Important

References

93 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:69607	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515302	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515303	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515306	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515307	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515308	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515311	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515313	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515314	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515316	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515317	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515321	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515322	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515325	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515326	external
https://bugzilla.redhat.com/show_bug.cgi?id=2515328	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-6464	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515306	external
https://www.cve.org/CVERecord?id=CVE-2026-6464	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6464	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-6471	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515307	external
https://www.cve.org/CVERecord?id=CVE-2026-6471	external
https://nvd.nist.gov/vuln/detail/CVE-2026-6471	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14662	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515302	external
https://www.cve.org/CVERecord?id=CVE-2026-14662	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14662	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14664	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515311	external
https://www.cve.org/CVERecord?id=CVE-2026-14664	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14664	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14668	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515326	external
https://www.cve.org/CVERecord?id=CVE-2026-14668	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14668	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14669	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515317	external
https://www.cve.org/CVERecord?id=CVE-2026-14669	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14669	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14670	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515325	external
https://www.cve.org/CVERecord?id=CVE-2026-14670	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14670	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14671	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515322	external
https://www.cve.org/CVERecord?id=CVE-2026-14671	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14671	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14677	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515313	external
https://www.cve.org/CVERecord?id=CVE-2026-14677	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14677	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14679	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515321	external
https://www.cve.org/CVERecord?id=CVE-2026-14679	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14679	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-14680	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515308	external
https://www.cve.org/CVERecord?id=CVE-2026-14680	external
https://nvd.nist.gov/vuln/detail/CVE-2026-14680	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-15742	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515314	external
https://www.cve.org/CVERecord?id=CVE-2026-15742	external
https://nvd.nist.gov/vuln/detail/CVE-2026-15742	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-16239	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515316	external
https://www.cve.org/CVERecord?id=CVE-2026-16239	external
https://nvd.nist.gov/vuln/detail/CVE-2026-16239	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-18408	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515303	external
https://www.cve.org/CVERecord?id=CVE-2026-18408	external
https://nvd.nist.gov/vuln/detail/CVE-2026-18408	external
https://www.postgresql.org/support/security/CVE-2…	external
https://access.redhat.com/security/cve/CVE-2026-19385	self
https://bugzilla.redhat.com/show_bug.cgi?id=2515328	external
https://www.cve.org/CVERecord?id=CVE-2026-19385	external
https://nvd.nist.gov/vuln/detail/CVE-2026-19385	external
https://www.postgresql.org/support/security/CVE-2…	external

JSON

To clipboard

Loading 1.0 MB of JSON…

CVE-2026-14662 (GCVE-0-2026-14662)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

Summary

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu, and Hcamael for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14662",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:52.206Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu, and Hcamael for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs.  This may execute arbitrary code as the operating system user running the database.  These types are typically sourced from application logic, not taken from the application\u0027s user.  Hence, application users attacking the database, through the application as a conduit, are unlikely.  CVE-2026-6473 had fixed similar problems.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:10.439Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14662/"
        }
      ],
      "title": "PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14662",
    "datePublished": "2026-08-13T13:00:01.726Z",
    "dateReserved": "2026-07-03T20:28:07.779Z",
    "dateUpdated": "2026-08-29T23:07:10.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14664 (GCVE-0-2026-14664)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL regexp heap buffer overflow executes arbitrary code

Summary

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Francesco Verardi for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14664",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:50.996Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Francesco Verardi for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation.  This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:12.593Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14664/"
        }
      ],
      "title": "PostgreSQL regexp heap buffer overflow executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14664",
    "datePublished": "2026-08-13T13:00:03.074Z",
    "dateReserved": "2026-07-03T20:28:09.038Z",
    "dateUpdated": "2026-08-29T23:07:12.593Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14668 (GCVE-0-2026-14668)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read

Summary

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 14:53 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Hcamael for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14668",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:53:46.205336Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:35:12.624Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Hcamael for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input.  While the calculation loses precision, substantial memory value recovery appears possible.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:14.539Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14668/"
        }
      ],
      "title": "PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14668",
    "datePublished": "2026-08-13T13:00:04.405Z",
    "dateReserved": "2026-07-03T20:28:11.432Z",
    "dateUpdated": "2026-08-29T23:07:14.539Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14669 (GCVE-0-2026-14669)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL to_char heap buffer overflow executes arbitrary code

Summary

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Hcamael, Amjad Shahzad, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14669",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:44.763Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Hcamael, Amjad Shahzad, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:15.483Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14669/"
        }
      ],
      "title": "PostgreSQL to_char heap buffer overflow executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14669",
    "datePublished": "2026-08-13T13:00:04.974Z",
    "dateReserved": "2026-07-03T20:28:11.993Z",
    "dateUpdated": "2026-08-29T23:07:15.483Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14670 (GCVE-0-2026-14670)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

Summary

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-122 - Heap-based Buffer Overflow

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Hcamael for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14670",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:43.429Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that.  Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Hcamael for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-122",
              "description": "Heap-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:16.457Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14670/"
        }
      ],
      "title": "PostgreSQL plperl tied object heap buffer overflow executes arbitrary code",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14670",
    "datePublished": "2026-08-13T13:00:05.626Z",
    "dateReserved": "2026-07-03T20:28:12.637Z",
    "dateUpdated": "2026-08-29T23:07:16.457Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14671 (GCVE-0-2026-14671)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL refint plan cache type confusion executes arbitrary code

Summary

Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Hcamael for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14671",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:27.908Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Superuser previously issued \"CREATE EXTENSION refint\".  Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Hcamael for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion in PostgreSQL module \"refint\" allows an object creator to execute arbitrary code as the operating system user running the database.  The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject \"refint: Remove plan cache.\", without a CVE number.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:38.626Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14671/"
        }
      ],
      "title": "PostgreSQL refint plan cache type confusion executes arbitrary code",
      "x_postgresql": {
        "component": "contrib module"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14671",
    "datePublished": "2026-08-13T13:00:18.697Z",
    "dateReserved": "2026-07-03T20:28:13.192Z",
    "dateUpdated": "2026-08-29T23:07:38.626Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14677 (GCVE-0-2026-14677)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound

Summary

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14677",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:42.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Attacker has permission to \"CREATE EXTENSION plperl\" or \"CREATE EXTENSION pltcl\"; alternatively, another user previously issued one of those.  Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies.  This may execute arbitrary code as the operating system user running the database.  CVE-2026-6473 had fixed similar problems.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:20.774Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14677/"
        }
      ],
      "title": "PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14677",
    "datePublished": "2026-08-13T13:00:08.067Z",
    "dateReserved": "2026-07-03T20:28:16.721Z",
    "dateUpdated": "2026-08-29T23:07:20.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14679 (GCVE-0-2026-14679)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory

Summary

Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 14:39 UTC

CWE

CWE-121 - Stack-based Buffer Overflow

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Zheng Yu (DepthFirst AI) and ylwangtju for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14679",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T14:39:15.363717Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-13T15:37:06.930Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Zheng Yu (DepthFirst AI) and ylwangtju for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count.  The attack can write only 0x0 and 0x1 bytes.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:23.054Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14679/"
        }
      ],
      "title": "PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14679",
    "datePublished": "2026-08-13T13:00:09.371Z",
    "dateReserved": "2026-07-03T20:28:17.880Z",
    "dateUpdated": "2026-08-29T23:07:23.054Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-14680 (GCVE-0-2026-14680)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL type confusion via "internal" arguments

Summary

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-14680",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:40.579Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Type confusion with PostgreSQL \"internal\" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type.  Type \"internal\" represents a class of mutually-incompatible data structures not intended for access from SQL.  The system intended to prevent such function calls, but this prevention had gaps.  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-843",
              "description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:24.073Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-14680/"
        }
      ],
      "title": "PostgreSQL type confusion via \"internal\" arguments",
      "x_postgresql": {
        "component": "core server"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-14680",
    "datePublished": "2026-08-13T13:00:10.037Z",
    "dateReserved": "2026-07-03T20:28:18.519Z",
    "dateUpdated": "2026-08-29T23:07:24.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-15742 (GCVE-0-2026-15742)

Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-29 23:07

Title

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound

Summary

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-13 00:00 UTC

CWE

CWE-190 - Integer Overflow or Wraparound

Assigner

PostgreSQL CNA under the redhat root

CNA scorecard C 68/100 over 155 records in the last 180 days details

References

1 reference

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Impacted products

1 product

Vendor	Product	Version
n/a	PostgreSQL	Affected: 18 , < 18.6 (rpm) Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm)

Credits

The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-15742",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-13T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-14T03:55:37.419Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.6",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.11",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.15",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.19",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.24",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Attacker has permission to \"CREATE EXTENSION fuzzystrmatch\", or another user previously issued that."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal().  Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T23:07:27.420Z",
        "orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "shortName": "PostgreSQL"
      },
      "references": [
        {
          "url": "https://www.postgresql.org/support/security/CVE-2026-15742/"
        }
      ],
      "title": "PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound",
      "x_postgresql": {
        "component": "contrib module"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
    "assignerShortName": "PostgreSQL",
    "cveId": "CVE-2026-15742",
    "datePublished": "2026-08-13T13:00:11.796Z",
    "dateReserved": "2026-07-14T14:24:10.871Z",
    "dateUpdated": "2026-08-29T23:07:27.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

RHSA-2026:69607

CVE-2026-14662 (GCVE-0-2026-14662)

CVE-2026-14664 (GCVE-0-2026-14664)

CVE-2026-14668 (GCVE-0-2026-14668)

CVE-2026-14669 (GCVE-0-2026-14669)

CVE-2026-14670 (GCVE-0-2026-14670)

CVE-2026-14671 (GCVE-0-2026-14671)

CVE-2026-14677 (GCVE-0-2026-14677)

CVE-2026-14679 (GCVE-0-2026-14679)

CVE-2026-14680 (GCVE-0-2026-14680)

CVE-2026-15742 (GCVE-0-2026-15742)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour