CVE-2026-6637 Read Assessment Published: 2026/06/22PostgreSQL refint allows stack buffer overflow and SQL injection PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6479 Read Assessment Published: 2026/06/22PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6477 Read Assessment Published: 2026/06/22PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6476 Read Assessment Published: 2026/06/22PostgreSQL pg_createsubscriber allows SQL injection via subscription name PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
Read More... |
CVE-2026-6475 Read Assessment Published: 2026/06/22PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6473 Read Assessment Published: 2026/06/22PostgreSQL server undersizes allocations, via integer wraparound PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6471 Read Assessment Published: 2026/08/13PostgreSQL logical decoding can dlopen arbitrary file PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Missing authorization in PostgreSQL logical decoding allows a non-superuser holding the REPLICATION privilege to specify a malicious logical decoding output plugin, causing the server to dlopen() an arbitrary file visible to the operating system account running PostgreSQL. This results in code execution with server privileges. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-6464 Read Assessment Published: 2026/08/13PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A command injection vulnerability in the psql client causes data rows to be interpreted as psql meta-commands rather than data, when a COPY FROM STDIN or \copy FROM STDIN command fails before the server signals it is ready to receive input rows. COPY FROM with a filename parameter is not affected. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-44477 Read Assessment Published: 2026/05/12Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, EDB Postgres® AI for CloudNativePG™ Cluster, EDB Postgres® AI for CloudNativePG™ Global Cluster
Summary: The CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres.
Read More... |
CVE-2026-3172 Read Assessment Published: 2026/03/10pgvector buffer overflow in parallel HNSW index build EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu
Summary: A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the pgvector extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun. This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
Read More... |
CVE-2026-2007 Read Assessment Published: 2026/02/12PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory Postgresql 18.0 and 18.1, EDB Postgres Extended Server prior to 18.2.0, EDB Postgres Advanced Server prior to 18.2.0
Summary: Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. Specifically affecting the pg_trgm extension, the vulnerability arises when crafted input causes an overflow, potentially leading to denial of service or privilege escalation.
Read More... |
CVE-2026-2006 Read Assessment Published: 2026/02/12PostgreSQL missing validation of multibyte character length executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. This can lead to arbitrary code execution as the operating system user running the database.
Read More... |
CVE-2026-2005 Read Assessment Published: 2026/02/12PostgreSQL pgcrypto heap buffer overflow executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Insufficient validation of ciphertext length and structure before copying decrypted data into heap-allocated buffers leads to memory corruption.
Read More... |
CVE-2026-2004 Read Assessment Published: 2026/02/12PostgreSQL intarray extension selectivity estimator executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Improper validation of input types in the PostgreSQL intarray extension allows an object creator to execute arbitrary code as the operating system user running the database server. An authenticated user with object creation privileges can bypass type validation checks in the selectivity estimator function to compromise the underlying host.
Read More... |
CVE-2026-19385 Read Assessment Published: 2026/08/13PostgreSQL pg_dump heap buffer overflow executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A heap buffer overflow in pg_dump allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-18408 Read Assessment Published: 2026/08/13PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: The psql \unrestrict meta-command bypasses the input-expansion restriction introduced to fix CVE-2025-8714, allowing a malicious superuser of a pg_dump origin server to inject arbitrary code for execution in the psql client during dump restoration. pg_dump, pg_dumpall, and pg_restore (when generating plain-format dumps) are affected. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-16239 Read Assessment Published: 2026/08/13PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Type confusion in PostgreSQL portal handling for EXECUTE and FETCH statements allows a database user to re-declare a cursor or other portal with a different type, corrupting the assumed type of the portal. This can be leveraged to disclose server memory contents and to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-16238 Read Assessment Published: 2026/08/13PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: Type confusion in PostgreSQL's pg_restore_attribute_stats() function, arising from conflation of range and multirange values, allows an object creator to execute arbitrary code as the operating system user running the database. This vulnerability only affects PostgreSQL 18.x; versions before PostgreSQL 18.5 are affected. PostgreSQL 17 and earlier are not affected.
Read More... |
CVE-2026-15742 Read Assessment Published: 2026/08/13PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Integer wraparound in the PostgreSQL fuzzystrmatch contrib module allows an authenticated user to direct writes to effectively-arbitrary memory addresses, potentially executing arbitrary code as the operating system user running the database, via extreme inputs to levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-15741 Read Assessment Published: 2026/08/13PostgreSQL expression deparse allows SQL injection via EXTRACT argument PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: SQL injection in PostgreSQL's expression deparse mechanism allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition and the EXTRACT() function, triggered when the object is later deparsed by pg_dump, psql \sf, or similar tooling. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14680 Read Assessment Published: 2026/08/13PostgreSQL type confusion via "internal" arguments PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Type confusion with PostgreSQL function arguments of the "internal" pseudo-type allows any user to execute arbitrary code as the operating system user running the database. The "internal" type represents data structures that are not intended to be reachable from SQL; existing protections against calling such functions contain gaps that allow the restriction to be bypassed. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14679 Read Assessment Published: 2026/08/13PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A stack buffer overflow in PostgreSQL's function argument-name matching allows an object creator to write only the byte values 0x0 and 0x1 to server memory, via a crafted OUT parameter count. Unlike most vulnerabilities in this batch, the confirmed CVSS vector reflects an availability-only impact rather than direct arbitrary code execution. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14676 Read Assessment Published: 2026/08/13PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: A heap buffer overflow in the PostgreSQL pg_stat_statements contrib module allows an authenticated user to execute arbitrary code with the privileges of the operating system user running the database, via crafted queries containing array constants. This vulnerability only affects PostgreSQL 18.x; versions before PostgreSQL 18.5 are affected. PostgreSQL 17 and earlier are not affected.
Read More... |
CVE-2026-14671 Read Assessment Published: 2026/08/13PostgreSQL refint plan cache type confusion executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Type confusion in the PostgreSQL refint contrib module allows an object creator to execute arbitrary code with the privileges of the operating system user running the database server. This fix was originally committed as a non-security bug fix before being assigned a CVE. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14670 Read Assessment Published: 2026/08/13PostgreSQL plperl tied object heap buffer overflow executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A heap buffer overflow in PostgreSQL's plperl handling of a returned tied hash allows a function owner to execute arbitrary code as the operating system user running the database, via a crafted plperl function body. Only deployments with plperl installed are affected. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14669 Read Assessment Published: 2026/08/13PostgreSQL to_char heap buffer overflow executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A heap buffer overflow in PostgreSQL's to_char(timestamptz) function allows an authenticated user who can choose the session timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14668 Read Assessment Published: 2026/08/13PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Type confusion in the PostgreSQL ctid data type's selectivity estimator allows an object creator to view a calculation derived from arbitrary 4-byte spans of server memory via non-ctid inputs. The recovered value loses precision, but substantial memory-content recovery is possible over repeated queries. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14664 Read Assessment Published: 2026/08/13PostgreSQL regexp heap buffer overflow executes arbitrary code PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: A heap buffer overflow in PostgreSQL's regexp functions allows a query author to execute arbitrary code as the operating system user running the database, triggered when text that fails encoding validation grows unexpectedly during a round-trip conversion through pg_wchar. This vulnerability shares heritage with CVE-2026-2006. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |
CVE-2026-14662 Read Assessment Published: 2026/08/13PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Integer wraparound in PostgreSQL's tsvector and tsquery functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds via crafted large inputs, which may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic rather than directly from end users, which limits practical exposure in most deployments. This is similar to CVE-2026-6473. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Read More... |