Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2026-AVI-1024
Vulnerability from certfr_avis - Published: 2026-08-14 - Updated: 2026-08-14
De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| PostgreSQL | N/A | PostgreSQL versions 16.x antérieures à 16.15 | ||
| PostgreSQL | N/A | PostgreSQL versions 18.x antérieures à 18.6 | ||
| PostgreSQL | N/A | PostgreSQL versions 15.x antérieures à 15.19 | ||
| PostgreSQL | N/A | PostgreSQL versions antérieures à 14.24 | ||
| PostgreSQL | N/A | PostgreSQL versions 17.x antérieures à 17.11 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "PostgreSQL versions 16.x ant\u00e9rieures \u00e0 16.15",
"product": {
"name": "N/A",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 18.x ant\u00e9rieures \u00e0 18.6",
"product": {
"name": "N/A",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 15.x ant\u00e9rieures \u00e0 15.19",
"product": {
"name": "N/A",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions ant\u00e9rieures \u00e0 14.24",
"product": {
"name": "N/A",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
},
{
"description": "PostgreSQL versions 17.x ant\u00e9rieures \u00e0 17.11",
"product": {
"name": "N/A",
"vendor": {
"name": "PostgreSQL",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2026-14671",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14671"
},
{
"name": "CVE-2026-16239",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16239"
},
{
"name": "CVE-2026-15742",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15742"
},
{
"name": "CVE-2026-6469",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6469"
},
{
"name": "CVE-2026-14681",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14681"
},
{
"name": "CVE-2026-14668",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14668"
},
{
"name": "CVE-2026-16241",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16241"
},
{
"name": "CVE-2026-18408",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18408"
},
{
"name": "CVE-2026-16238",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16238"
},
{
"name": "CVE-2026-19385",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-19385"
},
{
"name": "CVE-2026-14662",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14662"
},
{
"name": "CVE-2026-6470",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6470"
},
{
"name": "CVE-2026-14669",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14669"
},
{
"name": "CVE-2026-14678",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14678"
},
{
"name": "CVE-2026-15741",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15741"
},
{
"name": "CVE-2026-14677",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14677"
},
{
"name": "CVE-2026-14680",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14680"
},
{
"name": "CVE-2026-14666",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14666"
},
{
"name": "CVE-2026-14673",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14673"
},
{
"name": "CVE-2026-14663",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14663"
},
{
"name": "CVE-2026-14676",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14676"
},
{
"name": "CVE-2026-6464",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6464"
},
{
"name": "CVE-2026-6471",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6471"
},
{
"name": "CVE-2026-14679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14679"
},
{
"name": "CVE-2026-14672",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14672"
},
{
"name": "CVE-2026-14664",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14664"
},
{
"name": "CVE-2026-14670",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14670"
},
{
"name": "CVE-2026-18024",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18024"
}
],
"initial_release_date": "2026-08-14T00:00:00",
"last_revision_date": "2026-08-14T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-1024",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-08-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Injection SQL (SQLi)"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans PostgreSQL. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans PostgreSQL",
"vendor_advisories": [
{
"published_at": "2026-08-13",
"title": "Bulletin de s\u00e9curit\u00e9 PostgreSQL postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365",
"url": "https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/"
}
]
}
CVE-2026-14676 (GCVE-0-2026-14676)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-13 15:36
VLAI
EPSS
VEX
Title
PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code
Summary
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:41 UTC
CWE
- CWE-122 - Heap-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14676",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:41:48.435820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:36:25.900Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "pg_stat_statements is enabled"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Sajeeb Lohani (with TrendAI Zero Day Initiative), Yuelin Wang, and David Korczynski (Claude and Ada Logics) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-122",
"description": "Heap-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:07.385Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14676/"
}
],
"title": "PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code",
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14676",
"datePublished": "2026-08-13T13:00:07.385Z",
"dateReserved": "2026-07-03T20:28:16.168Z",
"dateUpdated": "2026-08-13T15:36:25.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14677 (GCVE-0-2026-14677)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound
Summary
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14677",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:42.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\" or \"CREATE EXTENSION pltcl\"; alternatively, another user previously issued one of those. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Tulya Project, Team Dhiutsa, Bitecope Technologies Private Ltd for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:08.067Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14677/"
}
],
"title": "PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14677",
"datePublished": "2026-08-13T13:00:08.067Z",
"dateReserved": "2026-07-03T20:28:16.721Z",
"dateUpdated": "2026-08-14T03:55:42.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14678 (GCVE-0-2026-14678)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-13 15:36
VLAI
EPSS
VEX
Title
PostgreSQL pg_trgm picksplit reads past end of buffer
Summary
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:39 UTC
CWE
- CWE-126 - Buffer Over-read
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14678",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:39:23.325065Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:36:52.887Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION pg_trgm\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-126",
"description": "Buffer Over-read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:08.713Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14678/"
}
],
"title": "PostgreSQL pg_trgm picksplit reads past end of buffer",
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14678",
"datePublished": "2026-08-13T13:00:08.713Z",
"dateReserved": "2026-07-03T20:28:17.298Z",
"dateUpdated": "2026-08-13T15:36:52.887Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14679 (GCVE-0-2026-14679)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-13 15:37
VLAI
EPSS
VEX
Title
PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory
Summary
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:39 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:39:15.363717Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:37:06.930Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zheng Yu (DepthFirst AI) and ylwangtju for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:09.371Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14679/"
}
],
"title": "PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14679",
"datePublished": "2026-08-13T13:00:09.371Z",
"dateReserved": "2026-07-03T20:28:17.880Z",
"dateUpdated": "2026-08-13T15:37:06.930Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14680 (GCVE-0-2026-14680)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL type confusion via "internal" arguments
Summary
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14680",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:40.579Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion with PostgreSQL \"internal\" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type \"internal\" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:10.037Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14680/"
}
],
"title": "PostgreSQL type confusion via \"internal\" arguments",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14680",
"datePublished": "2026-08-13T13:00:10.037Z",
"dateReserved": "2026-07-03T20:28:18.519Z",
"dateUpdated": "2026-08-14T03:55:40.579Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14681 (GCVE-0-2026-14681)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-13 15:37
VLAI
EPSS
VEX
Title
PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL
Summary
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
Severity
4.2 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 14:38 UTC
CWE
- CWE-924 - Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14681",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T14:38:14.009555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T15:37:34.410Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "pg_hba.conf entries would otherwise require GSSAPI"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks p4p3r for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-924",
"description": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:10.613Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14681/"
}
],
"title": "PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-14681",
"datePublished": "2026-08-13T13:00:10.613Z",
"dateReserved": "2026-07-03T20:28:19.093Z",
"dateUpdated": "2026-08-13T15:37:34.410Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15741 (GCVE-0-2026-15741)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL expression deparse allows SQL injection via EXTRACT argument
Summary
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15741",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:38.780Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create non-temporary objects in at least one schema"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \\sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-89",
"description": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:11.206Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-15741/"
}
],
"title": "PostgreSQL expression deparse allows SQL injection via EXTRACT argument",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-15741",
"datePublished": "2026-08-13T13:00:11.206Z",
"dateReserved": "2026-07-14T14:24:10.232Z",
"dateUpdated": "2026-08-14T03:55:38.780Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15742 (GCVE-0-2026-15742)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
Summary
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-190 - Integer Overflow or Wraparound
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15742",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:37.419Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION fuzzystrmatch\", or another user previously issued that."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-190",
"description": "Integer Overflow or Wraparound",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:11.796Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-15742/"
}
],
"title": "PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound",
"x_postgresql": {
"component": "contrib module"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-15742",
"datePublished": "2026-08-13T13:00:11.796Z",
"dateReserved": "2026-07-14T14:24:10.871Z",
"dateUpdated": "2026-08-14T03:55:37.419Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16238 (GCVE-0-2026-16238)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code
Summary
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16238",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:36.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:12.450Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16238/"
}
],
"title": "PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code",
"workarounds": [
{
"lang": "en",
"value": "Revoke public EXECUTE permission on the function"
}
],
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16238",
"datePublished": "2026-08-13T13:00:12.450Z",
"dateReserved": "2026-07-20T01:55:07.055Z",
"dateUpdated": "2026-08-14T03:55:36.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16239 (GCVE-0-2026-16239)
Vulnerability from cvelistv5 – Published: 2026-08-13 13:00 – Updated: 2026-08-14 03:55
VLAI
EPSS
VEX
Title
PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code
Summary
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-13 00:00 UTC
CWE
- CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | PostgreSQL |
Affected:
18 , < 18.5
(rpm)
Affected: 17 , < 17.11 (rpm) Affected: 16 , < 16.15 (rpm) Affected: 15 , < 15.19 (rpm) Affected: 0 , < 14.24 (rpm) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16239",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-13T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-14T03:55:34.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.5",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.11",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.15",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.19",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.24",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Ben Morris (Claude and Anthropic Research) for reporting this problem."
}
],
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL \"portal\"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-843",
"description": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T13:00:13.131Z",
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL"
},
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16239/"
}
],
"title": "PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code",
"x_postgresql": {
"component": "core server"
}
}
},
"cveMetadata": {
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"assignerShortName": "PostgreSQL",
"cveId": "CVE-2026-16239",
"datePublished": "2026-08-13T13:00:13.131Z",
"dateReserved": "2026-07-20T01:55:33.311Z",
"dateUpdated": "2026-08-14T03:55:34.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…