CVE-2026-6637 Read Assessment Published: 2026/06/22PostgreSQL refint allows stack buffer overflow and SQL injection PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6479 Read Assessment Published: 2026/06/22PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6477 Read Assessment Published: 2026/06/22PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6476 Read Assessment Published: 2026/06/22PostgreSQL pg_createsubscriber allows SQL injection via subscription name PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, and CloudNativePG
Summary: SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.
Read More... |
CVE-2026-6475 Read Assessment Published: 2026/06/22PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-6473 Read Assessment Published: 2026/06/22PostgreSQL server undersizes allocations, via integer wraparound PostgreSQL, EDB Postgres Advanced Server, EDB Postgres Extended Server, WarehousePG, and CloudNativePG
Summary: Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Read More... |
CVE-2026-44477 Read Assessment Published: 2026/05/12Metrics exporter allows privilege escalation to PostgreSQL superuser and OS RCE EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, EDB Postgres® AI for CloudNativePG™ Cluster, EDB Postgres® AI for CloudNativePG™ Global Cluster
Summary: The CloudNativePG metrics exporter opens its PostgreSQL connection as the postgres superuser via the pod-local Unix socket, then demotes the session with SET ROLE pg_monitor. SET ROLE changes only current_user; session_user remains postgres.
Read More... |
CVE-2026-3172 Read Assessment Published: 2026/03/10pgvector buffer overflow in parallel HNSW index build EDB Postgres Extended Server, EDB Postgres Advanced Server, EDB Cloud Service (formerly BigAnimal), Hybrid Manager (HM), EDB Postgres® AI for CloudNativePG™, WarehousePG, pgvector versions 0.6.0-0.8.1, aidb, pgpu
Summary: A buffer overflow in the parallel HNSW (Hierarchical Navigable Small World) index build process in the pgvector extension allows an authenticated database user to issue crafted queries that achieve a buffer overrun. This can lead to the leaking of sensitive data from other relations or a crash of the database server. The vulnerability is specifically triggered during concurrent index construction when multiple worker processes are utilized.
Read More... |
CVE-2026-2007 Read Assessment Published: 2026/02/12PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory Postgresql 18.0 and 18.1, EDB Postgres Extended Server prior to 18.2.0, EDB Postgres Advanced Server prior to 18.2.0
Summary: Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. Specifically affecting the pg_trgm extension, the vulnerability arises when crafted input causes an overflow, potentially leading to denial of service or privilege escalation.
Read More... |
CVE-2026-2006 Read Assessment Published: 2026/02/12PostgreSQL missing validation of multibyte character length executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. This can lead to arbitrary code execution as the operating system user running the database.
Read More... |
CVE-2026-2005 Read Assessment Published: 2026/02/12PostgreSQL pgcrypto heap buffer overflow executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Insufficient validation of ciphertext length and structure before copying decrypted data into heap-allocated buffers leads to memory corruption.
Read More... |
CVE-2026-2004 Read Assessment Published: 2026/02/12PostgreSQL intarray extension selectivity estimator executes arbitrary code All versions of Postgresql prior to 18.2, 17.8, 16.12, 15.16, 14.21, EDB Postgres Extended Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0, EDB Postgres Advanced Server prior to 18.2.0, 17.8.0, 16.12.0, 15.16.0, 14.21.0
Summary: Improper validation of input types in the PostgreSQL intarray extension allows an object creator to execute arbitrary code as the operating system user running the database server. An authenticated user with object creation privileges can bypass type validation checks in the selectivity estimator function to compromise the underlying host.
Read More... |