GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

ALSA-2026:67848

Vulnerability from osv_almalinux – Published: 2026-09-16 00:00 – Updated: 2026-09-17 13:32 – Source website
VLAI
Summary
Important: postgresql:18 security update
Details

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

  • postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)
  • postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)
  • postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)
  • postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)
  • postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)
  • postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)
  • postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)
  • postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)
  • postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)
  • postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)
  • postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)
  • postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)
  • postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)
  • postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)
  • postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)
  • postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References
https://access.redhat.com/errata/RHSA-2026:67848 ADVISORY
https://access.redhat.com/security/cve/CVE-2026-14662 REPORT
https://access.redhat.com/security/cve/CVE-2026-14664 REPORT
https://access.redhat.com/security/cve/CVE-2026-14668 REPORT
https://access.redhat.com/security/cve/CVE-2026-14669 REPORT
https://access.redhat.com/security/cve/CVE-2026-14670 REPORT
https://access.redhat.com/security/cve/CVE-2026-14671 REPORT
https://access.redhat.com/security/cve/CVE-2026-14676 REPORT
https://access.redhat.com/security/cve/CVE-2026-14677 REPORT
https://access.redhat.com/security/cve/CVE-2026-14679 REPORT
https://access.redhat.com/security/cve/CVE-2026-14680 REPORT
https://access.redhat.com/security/cve/CVE-2026-15741 REPORT
https://access.redhat.com/security/cve/CVE-2026-15742 REPORT
https://access.redhat.com/security/cve/CVE-2026-16238 REPORT
https://access.redhat.com/security/cve/CVE-2026-16239 REPORT
https://access.redhat.com/security/cve/CVE-2026-18408 REPORT
https://access.redhat.com/security/cve/CVE-2026-19385 REPORT
https://access.redhat.com/security/cve/CVE-2026-6464 REPORT
https://access.redhat.com/security/cve/CVE-2026-6471 REPORT
https://access.redhat.com/security/cve/CVE-2026-6476 REPORT
https://access.redhat.com/security/cve/CVE-2026-73515 REPORT
https://bugzilla.redhat.com/2477437 REPORT
https://bugzilla.redhat.com/2515302 REPORT
https://bugzilla.redhat.com/2515303 REPORT
https://bugzilla.redhat.com/2515306 REPORT
https://bugzilla.redhat.com/2515307 REPORT
https://bugzilla.redhat.com/2515308 REPORT
https://bugzilla.redhat.com/2515311 REPORT
https://bugzilla.redhat.com/2515313 REPORT
https://bugzilla.redhat.com/2515314 REPORT
https://bugzilla.redhat.com/2515316 REPORT
https://bugzilla.redhat.com/2515317 REPORT
https://bugzilla.redhat.com/2515319 REPORT
https://bugzilla.redhat.com/2515321 REPORT
https://bugzilla.redhat.com/2515322 REPORT
https://bugzilla.redhat.com/2515324 REPORT
https://bugzilla.redhat.com/2515325 REPORT
https://bugzilla.redhat.com/2515326 REPORT
https://bugzilla.redhat.com/2515328 REPORT
https://bugzilla.redhat.com/2515332 REPORT
https://bugzilla.redhat.com/2515434 REPORT
https://errata.almalinux.org/9/ALSA-2026-67848.html ADVISORY
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "pg_repack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.5.3-1.module_el9.8.0+234+5456f35d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "pgaudit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.0-1.module_el9.8.0+234+5456f35d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "pgvector"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.8.1-1.module_el9.8.0+234+5456f35d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgis"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-4.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgis-client"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-4.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgis-docs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-4.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgis-upgrade"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-4.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgis-utils"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.6.1-4.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgres-decoderbufs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.1-1.Final.module_el9.8.0+234+5456f35d"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-contrib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-docs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-plperl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-plpython3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-pltcl"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-private-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-private-libs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-server-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-static"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-test"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-test-rpm-macros"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-upgrade"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "AlmaLinux:9",
        "name": "postgresql-upgrade-devel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "18.6-1.module_el9.8.0+310+22372bcc"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "PostgreSQL is an advanced object-relational database management system (DBMS).  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in \u0027refint\u0027 module (CVE-2026-14671)\n  * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n",
  "id": "ALSA-2026:67848",
  "modified": "2026-09-17T13:32:27Z",
  "published": "2026-09-16T00:00:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:67848"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14662"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14664"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14668"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14669"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14670"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14671"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14676"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14677"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14679"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-14680"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15741"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-15742"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16238"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-16239"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-18408"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-19385"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-6464"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-6471"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-6476"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2026-73515"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2477437"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515302"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515303"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515306"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515307"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515308"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515311"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515313"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515314"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515316"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515317"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515319"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515322"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515324"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515325"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515326"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515328"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515332"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/2515434"
    },
    {
      "type": "ADVISORY",
      "url": "https://errata.almalinux.org/9/ALSA-2026-67848.html"
    }
  ],
  "related": [
    "CVE-2026-6476",
    "CVE-2026-14662",
    "CVE-2026-18408",
    "CVE-2026-6464",
    "CVE-2026-6471",
    "CVE-2026-14680",
    "CVE-2026-14664",
    "CVE-2026-14677",
    "CVE-2026-15742",
    "CVE-2026-16239",
    "CVE-2026-14669",
    "CVE-2026-16238",
    "CVE-2026-14679",
    "CVE-2026-14671",
    "CVE-2026-14676",
    "CVE-2026-14670",
    "CVE-2026-14668",
    "CVE-2026-19385",
    "CVE-2026-15741",
    "CVE-2026-73515"
  ],
  "summary": "Important: postgresql:18 security update"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.