CVE-2026-2005

CVE-2026-2005 - PostgreSQL pgcrypto Heap Overflow Exploit PoC exploit for a heap-based buffer overflow in the PostgreSQL pgcrypto extension's PGP session key parsing, leading to arbitrary memory read/write and privilege escalation to superuser. For full technical details, see the Zeroday Cloud...

CVE-2026-2005

Upstream patch for CVE-2026-2005 pgcrypto, PostgreSQL 17.7 → 17.8...

CVE-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Buffer Overflow Target commit: 4b324845ba5d24682b9b3708a769f00d160afbd7 PostgreSQL 18.1 — vulnerable Summary Field| Detail ---|--- CVE| CVE-2026-2005 Type| Heap buffer overflow Component| contrib/pgcrypto/pgp-pubdec.c — pgpparsepubencsesskey Impact| RCE as...

CVE-2026-2005_lab

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow Lab A self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension that enables remote code execution without superuser privileges. Affected versions: PostgreSQL ≤ 17.7 / 16.11 /...

cve-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow → RCE Remote code execution via a single SQL query targeting PostgreSQL's pgcrypto extension. The vulnerability is a heap buffer overflow in pgpparsepubencsesskey that allows corruption of PostgreSQL's internal MemoryContext allocator metadata,...

CVE-2026-14663

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

SUSE SLES12: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (SUSE-SU-2026:3794-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3794-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-104784)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104784 advisory. Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version an...

OESA-2026-3424 postgresql-17 security update

PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...

OESA-2026-3423 postgresql-17 security update

PostgreSQL client programs Security Fixes: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the...

OESA-2026-3420 postgresql security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

The vulnerability of the pgcrypto module in the PostgreSQL database management system allows a hacker to gain unauthorized access to protected information.

The vulnerability of the pgcrypto module in the PostgreSQL database management system is related to the unencrypted storage of user credentials. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

BIT-POSTGRESQL-2026-14663 PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

SUSE CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers

A flaw was found in PostgreSQL pgcrypto. When using disabled ciphers, a user can recover cleartext data by observing faulty ciphertext. This issue arises because the application may accept encrypted data as input, leading to successful decryption even with an incorrect key. Consequently, the...

Cleartext Storage in a File or on Disk

Overview Affected versions of this package are vulnerable to Cleartext Storage in a File or on Disk in the pgcrypto process when OpenSSL-disabled ciphers are used. An attacker can access sensitive information and potentially modify data by observing the faulty ciphertext or submitting encrypted...

CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

ALPINE-CVE-2026-14663

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...

AZL-95723 CVE-2026-14663 affecting package postgresql 16.14-1

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed...