Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the authentication process. An attacker can determine whether a specific user exists by observing differences in the SCRAM authentication challenge when the targeted user has a non-default scramiterations value...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path via the amcheck function. An attacker can execute arbitrary functions with the privileges of expression index owners by setting a malicious search path prior to invoking the amcheck function. Remediation Upgrade...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read in the picksplit process. An attacker can infer limited memory values by observing the behavior of index split choices. Remediation Upgrade libpq to version 14.24, 15.19, 16.15, 17.11 or higher. References - Postgres...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via crafted function bodies in the pltcl or plperl process. An attacker can execute arbitrary code as the operating system user running the database by causing undersized memory allocations and writing...

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the argument name matching process. An attacker can cause unauthorized memory modification and potentially disrupt server operation by supplying specially crafted OUT parameter counts. Remediation Upgrade...

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the ECPG process. An attacker can cause the client to overwrite a large memory region with uncontrolled bytes by sending a specially crafted bytea value lacking the required prefix. This can resu...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the portal lifecycle when a cursor is closed and then re-declared with different types. An attacker can execute arbitrary code as the operating system user running the...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the \unrestrict meta-command input expansion in the restore process. An attacker can execute arbitrary code as the client operating system account by injecting malicious input from a compromised origin...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the pgdump process when handling crafted transform lists. An attacker can execute arbitrary code as the operating system user running pgdump by supplying a specially crafted transform list. Remediation...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the COPY FROM STDIN process. An attacker can execute arbitrary commands by injecting specially crafted data lines when an early failure occurs before the server signals readiness for input rows. This is...

Incorrect Ownership Assignment

Overview Affected versions of this package are vulnerable to Incorrect Ownership Assignment in the ALTER TABLE ALTER TYPE process. An attacker can gain unauthorized ability to execute DROP STATISTICS and ALTER STATISTICS on affected objects by exploiting improper reassignment of ownership...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization due to insufficient authorization checks in the logical decoding process. An attacker can execute arbitrary code with the privileges of the operating system account running the server by specifying a crafted logica...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the process of assigning a range subtype or referencing a type from an SQL expression. An attacker can prevent legitimate users from altering or dropping a type by creating a dependency on it without the requir...

org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A remote attacker who can intercept a TLS Transport Layer Security connection can silently downgrade connections configured to require channel binding from SCRAM-SHA-256-PLUS to plain SCRAM-SHA-256. This downgrade bypasses the...

ALPINE-CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

CVE-2026-6469

Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the...

AZL-95738 CVE-2026-6470 affecting package postgresql for versions less than 16.15-1

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL...

CVE-2026-6464

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line...

ALPINE-CVE-2026-6471

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before...

CVE-2026-6471

Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before...