[SECURITY] [DSA 6270-1] postgresql-17 security update

🗓️ 14 May 2026 14:26:16Reported by DebianType

debian

debian🔗 lists.debian.org👁 27 Views

Debian fixes multiple PostgreSQL vulnerabilities in postgresql-17; upgrade to 17.10-0+deb13u1.

Reporter	Title	Published	Views	Family All 1009
Vulnrichment	CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6474 PostgreSQL timeofday() can disclose portions of server memory	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6475 PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6476 PostgreSQL pg_createsubscriber allows SQL injection via subscription name	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6479 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6637 PostgreSQL refint allows stack buffer overflow and SQL injection	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6638 PostgreSQL REFRESH PUBLICATION allows SQL injection via table name	14 May 202613:00	–	vulnrichment
Vulnrichment	CVE-2026-6472 PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege	14 May 202613:00	–	vulnrichment

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	13	amd64	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_amd64.deb
Debian	13	arm64	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_arm64.deb
Debian	13	armel	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_armel.deb
Debian	13	armhf	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_armhf.deb
Debian	13	i386	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_i386.deb
Debian	13	ppc64el	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_ppc64el.deb
Debian	13	riscv64	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_riscv64.deb
Debian	13	s390x	libecpg-compat3	17.10-0+deb13u1	libecpg-compat3_17.10-0+deb13u1_s390x.deb
Debian	13	amd64	libecpg-compat3-dbgsym	17.10-0+deb13u1	libecpg-compat3-dbgsym_17.10-0+deb13u1_amd64.deb
Debian	13	arm64	libecpg-compat3-dbgsym	17.10-0+deb13u1	libecpg-compat3-dbgsym_17.10-0+deb13u1_arm64.deb

14 May 2026 14:26Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.8

EPSS0.01006

SSVC

postgresql-17 security update authorization bypass code execution information disclosure privilege escalation sql injection denial of service version 17.10-0+deb13u1