PostgreSQL fixes 5 vulnerabilities

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] PostgreSQL fixes 5 vulnerabilities

PostgreSQL versions 18.2, 17.8, 16.12, 15.16 and 14.21 fix 5 vulnerabilities. The most severe ones are described below; the remaining ones can be found at [1].

PostgreSQL - arbitrary code execution (CVE-2026-2004)

CVSS 8.8 (High)

Allows an authenticated remote attacker to execute arbitrary code with the privileges of the user running the database due to a missing input type check in a PostgreSQL extension [1].

The vulnerability is present in product:

PostgreSQL; >=18.0, <18.2; >=17.0, <17.8; >=16.0, <16.12; >=15.0, <15.16; >=14.0,<14.21

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-2004 at cve.org, NVD
CWE-1287: Improper Validation of Specified Type of Input at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2026.

PostgreSQL - arbitrary code execution (CVE-2026-2005)

CVSS 8.8 (High)

Allows an authenticated remote attacker to execute arbitrary code with the privileges of the user running the database via malicious encrypted input in a PostgreSQL extension [1].

The vulnerability is present in product:

PostgreSQL; >=18.0, <18.2; >=17.0, <17.8; >=16.0, <16.12; >=15.0, <15.16; >=14.0,<14.21

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-2005 at cve.org, NVD
CWE-122: Heap-based Buffer Overflow at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2026.

PostgreSQL - arbitrary code execution (CVE-2026-2006)

CVSS 8.8 (High)

Allows an authenticated remote attacker to trigger a buffer overflow via crafted queries and execute arbitrary code with the privileges of the user running the database, due to a missing length check of multibyte characters in PostgreSQL text functions [1].

The vulnerability is present in product:

PostgreSQL; >=18.0, <18.2; >=17.0, <17.8; >=16.0, <16.12; >=15.0, <15.16; >=14.0,<14.21

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-2006 at cve.org, NVD
CWE-129: Improper Validation of Array Index at cwe.mitre.org

The vulnerability was publicly disclosed 12. 2. 2026.

Report feedback

[TLP:CLEAR] PostgreSQL fixes 5 vulnerabilities

PostgreSQL - arbitrary code execution (CVE-2026-2004)

CVSS 8.8 (High)

PostgreSQL - arbitrary code execution (CVE-2026-2005)

CVSS 8.8 (High)

PostgreSQL - arbitrary code execution (CVE-2026-2006)

CVSS 8.8 (High)

Links