postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp

A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the...

postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin

A flaw was found in PostgreSQL. Missing authorization in PostgreSQL's logical decoding feature allows a non-superuser with REPLICATION privilege to load arbitrary files. This can lead to arbitrary code execution as the operating system account running the server...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-6669

A flaw was found in PgBouncer. A malicious or compromised PostgreSQL backend can exploit a missing upper bound on the key derivation iteration count during SCRAM Salted Challenge Response Authentication Mechanism authentication. This can lead to uncontrolled CPU consumption in PgBouncer,...

EUVD-2026-85535

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71461 Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71461

The Red Hat Ansible Automation Platform 2.7 Container Release is affected by CVE-2026-71461, which involves a verbose internal exception disclosure in the HostList.list() function. The component catches a bare Exception and returns the error string verbatim. An authenticated user can trigger a Dj...

CVE-2026-71461 Automation-controller: automation-controller-container: automation-controller: verbose internal exception disclosure via hostlist bare-exception handler

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

CVE-2026-71461

HostList.list catches bare Exception and returns stre verbatim. Via hostfilter, any authenticated user triggers Django FieldError leaking complete Host model relation graph including internal reverse accessors or PostgreSQL DataError leaking raw database error strings. Two primitives:...

postgresql16 security update

An update is available for postgresql16. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced Object-Relational database management system...

RLSA-2026:70186 Important: postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

RLSA-2026:69607 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

postgresql security update

An update is available for postgresql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced object-relational database management system DBM...

RLSA-2026:69924 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY...

postgresql:12 security update

An update is available for module.pgrepack, module.postgres-decoderbufs, module.pgaudit, pgrepack, postgres-decoderbufs, postgresql, pgaudit, module.postgresql. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

DEBIAN-CVE-2026-6669

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

CVE-2026-6669

Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. The resulting key derivation cannot be interrupte...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...

postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions

A flaw was found in PostgreSQL. An unprivileged database user can exploit an integer wraparound vulnerability in the tsvector and tsquery data type functions. By providing crafted large inputs, the server can be forced to undersize an allocation, leading to an out-of-bounds write. This could...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...