CVE-2026-15742: Integer Overflow or Wraparound

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein or levenshteinlessequal. Versions before PostgreSQL 18.5, 17.11,...

CVE-2026-16238: Access of Resource Using Incompatible Type

Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-14662: Integer Overflow or Wraparound

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These...

CVE-2026-16241: Integer Underflow (Wrap or Wraparound)

Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This...

CVE-2026-15741: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before...

CVE-2026-14664: Heap-based Buffer Overflow

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

CVE-2026-14676: Heap-based Buffer Overflow

Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

CVE-2026-16239: Access of Resource Using Incompatible Type

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

Vulnerability in core server (CVE-2026-14680)

PostgreSQL type confusion via "internal" arguments Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of...

Linux Distros Unpatched Vulnerability : CVE-2026-14663

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL versi...

RHEL 9 : postgresql-jdbc (RHSA-2026:54532)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:54532 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...

Linux Distros Unpatched Vulnerability : CVE-2026-18024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This...

PostgreSQL -- Multiple vulnerabilities

The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before data rows begin, processes the following data lines as psql commands. CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns ownership of dependent extended statistics objects to the current user...

CVE-2026-14681: Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.conf rules, via initial direct TLS connection. Despite a pghba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS...

Vulnerability in core server (CVE-2026-16238)

PostgreSQL type confusion in pgrestoreattributestats executes arbitrary code Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major versi...

Vulnerability in client (CVE-2026-18408)

PostgreSQL psql \unrestrict lets superuser of pgdump origin server execute arbitrary code in psql client Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account...

Vulnerability in client (CVE-2026-16241)

PostgreSQL ECPG integer underflow can crash the client Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with...

Vulnerability in core server (CVE-2026-16239)

PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions...

Vulnerability in client (CVE-2026-19385)

PostgreSQL pgdump heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL pgdump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pgdump, via a crafted transform list. Versions before PostgreSQL 18.6,...

Vulnerability in core server (CVE-2026-18024)

PostgreSQL ascii function reads past end of buffer Buffer over-read in PostgreSQL ascii SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less...