Vulnerability in core server (CVE-2026-14677)

PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitra...

Vulnerability in core server (CVE-2026-14672)

PostgreSQL observable response discrepancy with non-default scramiterations provides user existence oracle Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the...

Vulnerability in contrib module (CVE-2026-14671)

PostgreSQL refint plan cache type confusion executes arbitrary code Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the g...

Vulnerability in core server (CVE-2026-14668)

PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chose...

Vulnerability in core server (CVE-2026-14670)

PostgreSQL plperl tied object heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL...

Vulnerability in core server (CVE-2026-14664)

PostgreSQL regexp heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006,...

Vulnerability in contrib module (CVE-2026-14663)

PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determin...

Vulnerability in contrib module (CVE-2026-14676)

PostgreSQL pgstatstatements heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18...

Vulnerability in core server (CVE-2026-14681)

PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI,...

Vulnerability in contrib module (CVE-2026-15742)

PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL...

Vulnerability in core server (CVE-2026-14662)

PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may...

Vulnerability in core server (CVE-2026-14669)

PostgreSQL tochar heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQ...

Vulnerability in core server (CVE-2026-6471)

PostgreSQL logical decoding can dlopen arbitrary file Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn ru...

Vulnerability in core server (CVE-2026-6469)

PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTI...

Vulnerability in client (CVE-2026-6464)

PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fai...

Vulnerability in core server (CVE-2026-6470)

PostgreSQL fails to check type USAGE privilege Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subty...

PostgreSQL -- Multiple vulnerabilities

The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands. CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user...

PT-2026-71481

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A type confusion issue exists in the portal and cursor...

PT-2026-71482

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description An integer underflow in the ECPG client allows a database...

PT-2026-71488

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description An incorrect ownership assignment occurs during the...