This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] PostgreSQL fixes 11 vulnerabilities
PostgreSQL versions 18.4, 17.10, 16.14, 15.18 and 14.23 fix 11 vulnerabilities. The most severe ones are described below, the rest can be found at [1].
An authenticated remote attacker with low database privileges can execute arbitrary code with the privileges of the operating system user under which the database runs due to SQL injection in the PostgreSQL refint module [2].
The vulnerability is present in product:
- PostgreSQL; >=18, <18.4; >=17, <17.10; >=16, <16.14; >=15, <15.18; >=14, <14.23
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6637 at cve.org, NVD
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 18. 5. 2026.
An unauthenticated remote attacker (who controls the database server) can overwrite the stack memory of a connected client with an arbitrarily large response and potentially execute code due to the use of the unsafe PQfn function in the lo_* functions of the libpq client library [3].
The vulnerability is present in product:
- PostgreSQL; >=18, <18.4; >=17, <17.10; >=16, <16.14; >=15, <15.18; >=14, <14.23
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6477 at cve.org, NVD
- CWE-242: Use of Inherently Dangerous Function at cwe.mitre.org
The vulnerability was publicly disclosed 18. 5. 2026.
An unauthenticated remote attacker (with superuser privileges on the source instance) can overwrite local files and potentially take control of an operating system account due to unchecked handling of symbolic links in PostgreSQL pg_basebackup and pg_rewind [4].
The vulnerability is present in product:
- PostgreSQL; >=18, <18.4; >=17, <17.10; >=16, <16.14; >=15, <15.18; >=14, <14.23
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6475 at cve.org, NVD
- CWE-61: UNIX Symbolic Link (Symlink) Following at cwe.mitre.org
The vulnerability was publicly disclosed 18. 5. 2026.
An authenticated remote attacker can cause an undersized memory allocation and an out-of-bounds write leading to DoS due to an integer overflow in multiple PostgreSQL server functions [5].
The vulnerability is present in product:
- PostgreSQL; >=18, <18.4; >=17, <17.10; >=16, <16.14; >=15, <15.18; >=14, <14.23
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-6473 at cve.org, NVD
- CWE-190: Integer Overflow or Wraparound at cwe.mitre.org
The vulnerability was publicly disclosed 18. 5. 2026.
Links
- [1] https://www.postgresql.org/support/security/
- [2] https://www.postgresql.org/support/security/CVE-2026-6637/
- [3] https://www.postgresql.org/support/security/CVE-2026-6477/
- [4] https://www.postgresql.org/support/security/CVE-2026-6475/
- [5] https://www.postgresql.org/support/security/CVE-2026-6473/
By CESNET, z.s.p.o. Michaela Jarošová on 5. 6. 2026.