Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2023_4527)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234527 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining...

Rocky Linux 9 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc Multiple Vulnerabilities (crlsa-2023_7785)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237785 advisory. postgresql: Buffer overrun from integer overflow in array modification CVE-2023-5869 postgresql: Memory disclosure in aggregate function calls CVE-2023-586...

Rocky Linux 9 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_10787)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410787 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable chang...

Rocky Linux 9 [CIQ] Security Update: pgaudit / pgaudit-debuginfo / pgaudit-debugsource / etc Multiple Vulnerabilities (crlsa-2023_4327)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234327 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining...

Rocky Linux 9 [CIQ] Security Update: postgresql / postgresql-contrib / postgresql-contrib-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_3714)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20233714 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_10831)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410831 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable chang...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_10830)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410830 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable chang...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2024_10785)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202410785 advisory. postgresql: PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID CVE-2024-10978 postgresql: PostgreSQL PL/Perl environment variable chang...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2023_4535)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20234535 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining...

Rocky Linux 8 [CIQ] Security Update: pg_repack / pg_repack-debuginfo / pg_repack-debugsource / pgaudit / etc Multiple Vulnerabilities (crlsa-2023_5269)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20235269 advisory. postgresql: schemaelement defeats protective searchpath changes CVE-2023-2454 postgresql: row security policies disregard user ID changes after inlining...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2023-002897)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002897 advisory. A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT. ...

Astra Linux – Vulnerability in PostgresSQL 11

Incomplete tracking of tables with row security in PostgreSQL allows a reused query to view or modify different rows than intended. CVE-2023-2455 and CVE-2016-2193 addressed most issues related to interactions between row security and changes to user IDs. However, they did not cover cases where a...

Astra Linux – Vulnerability in PostgresSQL 11

Row security policies ignore changes to user IDs after inline operations. PostgreSQL may allow incorrect policies to be applied in certain cases where role-specific policies are used, and where a given query is planned to be executed under one role and then executed under another role. This...

USN-8653-1 postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

BIT-POSTGRESQL-2026-14666 PostgreSQL row security caching disregards role modifications

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099449 advisory. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data...

PostgreSQL row security caching disregards role modifications

...

CVE-2026-14666

CVE-2026-14666 affects PostgreSQL prior to versions 18.5, 17.11, 16.15, 15.19, and 14.24. The issue is incomplete tracking of changes to role membership, role attributes, and database ownership, causing a query to continue using cached row-level security policies after a policy change requires a ...

Vulnerability in core server (CVE-2026-14666)

PostgreSQL row security caching disregards role modifications Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse...