AZL-86831 CVE-2026-6474 affecting package postgresql for versions less than 16.14-1

🗓️ 14 May 2026 14:16:24Reported by GoogleType

osv🔗 osv.dev👁 4 Views

Format string in PostgreSQL timeofday() via crafted timezone zones leaks server memory.

Reporter	Title	Published	Views	Family All 213
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	16 Jun 202615:07	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for July 2026.	5 Aug 202607:31	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in IBM AIX and PowerVM VIOS	21 Aug 202616:38	–	ibm
FreeBSD	PostgreSQL -- Multiple vulnerabilities	14 May 202600:00	–	freebsd
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59563)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59564)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59565)	21 Aug 202600:00	–	nessus
Tenable Nessus	AIX : Multiple Vulnerabilities (IJ59566)	21 Aug 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : postgresql17, postgresql17-contrib, postgresql17-llvmjit (ALAS2023-2026-1766)	8 Jun 202600:00	–	nessus
Tenable Nessus	Amazon Linux 2023 : postgresql16, postgresql16-contrib, postgresql16-llvmjit (ALAS2023-2026-1767)	8 Jun 202600:00	–	nessus

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-6474

28 Aug 2026 17:46Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.14.3

EPSS0.00214

SSVC

PostgreSQL format string timeofday function timezone zones memory disclosure library