Every CVE Search/ Get API key

CVE-2026-16238

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

8.8 HighFix available

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.41%Down 0.2 points since Aug 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 8.8

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-843
Updated
2026-11-02
EUVDEUVD-2026-57848 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
EUVD-2026-57848
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-6q3v-qqc9-g2rv 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute...

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

Record
GHSA-6q3v-qqc9-g2rv
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-843
Updated
2026-11-02
NVD 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-843
Updated
2026-11-02
OSVALPINE-CVE-2026-16238 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
ALPINE-CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSVBELL-CVE-2026-16238 8.8
Record
BELL-CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 17 moreShow less
OSVDEBIAN-CVE-2026-16238 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
DEBIAN-CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:67280 8.8

Red Hat Security Advisory: postgresql18 security update

Record
RHSA-2026:67280
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2026:67848 8.8

Red Hat Security Advisory: postgresql:18 security update

Record
RHSA-2026:67848
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:67280 8.8

Important: postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

  • postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)

  • postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)

  • postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)

  • postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)

  • postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)

  • postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

  • postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)

  • postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)

  • postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)

  • postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)

  • postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)

  • postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)

  • postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)

  • postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)

  • postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67280
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRLSA-2026:67848 8.8

Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

  • postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)

  • postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)

  • postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)

  • postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)

  • postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)

  • postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

  • postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)

  • postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)

  • postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)

  • postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)

  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)

  • postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)

  • postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)

  • postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)

  • postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)

  • postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

  • postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
RLSA-2026:67848
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-16238 8.8

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
UBUNTU-CVE-2026-16238
CVSS 3.1
8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVALSA-2026:67280 No score

Important: postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

  • postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)
  • postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)
  • postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)
  • postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)
  • postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)
  • postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)
  • postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)
  • postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)
  • postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)
  • postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)
  • postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)
  • postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)
  • postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)
  • postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)
  • postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67280
Updated
2026-11-02
OSVALSA-2026:67848 No score

Important: postgresql:18 security update

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

  • postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)
  • postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)
  • postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)
  • postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)
  • postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)
  • postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)
  • postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)
  • postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)
  • postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)
  • postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)
  • postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)
  • postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)
  • postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)
  • postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)
  • postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)
  • postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)
  • postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record
ALSA-2026:67848
Updated
2026-11-02
OSVBIT-postgresql-2026-16238 No score

PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

Record
BIT-postgresql-2026-16238
Updated
2026-11-02
OSVMGASA-2026-0347 No score

Updated postgresql18 & postgresql15 packages fix security vulnerabilities

psql COPY FROM STDIN early failure processes data lines as psql commands. (CVE-2026-6464) ALTER TABLE ALTER TYPE resets extended statistics ownership. (CVE-2026-6469) Fails to check type USAGE privilege. (CVE-2026-6470) Logical decoding can dlopen arbitrary file. (CVE-2026-6471) tsvector and tsquery undersize allocations, via integer wraparound. (CVE-2026-14662) pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext. (CVE-2026-14663) Regexp heap buffer overflow executes arbitrary code. (CVE-2026-14664) Row security caching disregards role modifications. (CVE-2026-14666) ctid type confusion in selectivity estimator discloses derivative of arbitrary read. (CVE-2026-14668) to_char heap buffer overflow executes arbitrary code. (CVE-2026-14669) plperl tied object heap buffer overflow executes arbitrary code. (CVE-2026-14670) refint plan cache type confusion executes arbitrary code. (CVE-2026-14671) Observable response discrepancy with non-default scram_iterations provides user existence oracle. (CVE-2026-14672) amcheck does not clear untrusted search path. (CVE-2026-14673) pg_stat_statements heap buffer overflow executes arbitrary code. (CVE-2026-14676) 32-bit pltcl and plperl undersize allocations, via integer wraparound. (CVE-2026-14677) pg_trgm picksplit reads past end of buffer. (CVE-2026-14678) Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory. (CVE-2026-14679) Type confusion via "internal" arguments. (CVE-2026-14680) Improper enforcement of GSSAPI encryption when coupled with SSL. (CVE-2026-14681) Expression deparse allows SQL injection via EXTRACT argument. (CVE-2026-15741) fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound. (CVE-2026-15742) Type confusion in pg_restore_attribute_stats() executes arbitrary code. (CVE-2026-16238) Type confusion in cursor CLOSE + DECLARE executes arbitrary code. (CVE-2026-16239) ECPG integer underflow can crash the client. (CVE-2026-16241) ascii() function reads past end of buffer. (CVE-2026-18024) psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client. (CVE-2026-18408) pg_dump heap buffer overflow executes arbitrary code. (CVE-2026-19385)

Record
MGASA-2026-0347
Updated
2026-11-02
OSVopenSUSE-SU-2026:11565-1 No score

libecpg6-18.6-1.1 on GA media

These are all security issues fixed in the libecpg6-18.6-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11565-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21703-1 No score

Security update for postgresql18

This update for postgresql18 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
  • CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

Record
openSUSE-SU-2026:21703-1
Updated
2026-11-02
OSVSUSE-SU-2026:23577-1 No score

Security update for postgresql18

This update for postgresql18 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
  • CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

Record
SUSE-SU-2026:23577-1
Updated
2026-11-02
OSVSUSE-SU-2026:3942-1 No score

Security update for postgresql18

This update for postgresql18 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
  • CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

Record
SUSE-SU-2026:3942-1
Updated
2026-11-02
OSVSUSE-SU-2026:4014-1 No score

Security update for postgresql18

This update for postgresql18 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
  • CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

Record
SUSE-SU-2026:4014-1
Updated
2026-11-02
OSVSUSE-SU-2026:4015-1 No score

Security update for postgresql18

This update for postgresql18 fixes the following issues:

  • CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
  • CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
  • CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
  • CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
  • CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
  • CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
  • CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
  • CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
  • CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
  • CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
  • CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
  • CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
  • CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
  • CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
  • CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
  • CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
  • CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
  • CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
  • CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
  • CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
  • CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
  • CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
  • CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
  • CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
  • CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
  • CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
  • CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
  • CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

Record
SUSE-SU-2026:4015-1
Updated
2026-11-02
OSVUSN-8653-1 No score

postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. (CVE-2026-6464)

It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER TABLE ALTER TYPE operations. An attacker could possibly use this issue to obtain sensitive information or gain unintended privileges. (CVE-2026-6469)

It was discovered that PostgreSQL failed to check the USAGE privilege on types. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-6470)

It was discovered that PostgreSQL logical decoding could load arbitrary shared libraries. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-6471)

It was discovered that PostgreSQL had integer wraparound issues in tsvector and tsquery allocations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14662)

It was discovered that PostgreSQL pgcrypto silently used cleartext when OpenSSL-disabled ciphers were requested. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14663)

It was discovered that PostgreSQL had a heap buffer overflow in regular expression processing. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14664)

It was discovered that PostgreSQL row security policies were not properly invalidated when roles were modified. An attacker could possibly use this issue to bypass intended row security restrictions. (CVE-2026-14666)

It was discovered that PostgreSQL had a type confusion issue in the selectivity estimator involving ctid. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14668)

It was discovered that PostgreSQL had a heap buffer overflow in the to_char function. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14669)

It was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl tied object handling. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14670)

It was discovered that PostgreSQL had a type confusion issue in the referential integrity plan cache. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14671)

It was discovered that PostgreSQL had an observable response discrepancy when non-default scram_iterations were used. A remote attacker could possibly use this issue to enumerate valid usernames. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-14672)

It was discovered that PostgreSQL amcheck did not clear untrusted search paths. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14673)

It was discovered that PostgreSQL had a heap buffer overflow in pg_stat_statements. An authenticated user could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14676)

It was discovered that PostgreSQL had integer wraparound issues in PL/Tcl and PL/Perl allocations on 32-bit systems. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14677)

It was discovered that PostgreSQL pg_trgm read past the end of a buffer during picksplit operations. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14678)

It was discovered that PostgreSQL had a stack buffer overflow in argument matching. An authenticated user could possibly use this issue to corrupt server memory. (CVE-2026-14679)

It was discovered that PostgreSQL had a type confusion issue when functions used internal arguments. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14680)

It was discovered that PostgreSQL did not properly enforce GSSAPI encryption when used…

Record
USN-8653-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
postgresql15
Alpine:v3.21
 before 15.19-r0
15.19-r0
postgresql15
Alpine:v3.22
 before 15.19-r0
15.19-r0
postgresql16
Alpine:v3.21
 before 16.15-r0
16.15-r0
postgresql16
Alpine:v3.22
 before 16.15-r0
16.15-r0
postgresql16
Alpine:v3.23
 before 16.15-r0
16.15-r0
postgresql16
Alpine:v3.24
 before 16.15-r0
16.15-r0
postgresql17
Alpine:v3.21
 before 17.11-r0
17.11-r0
postgresql17
Alpine:v3.22
 before 17.11-r0
17.11-r0
postgresql17
Alpine:v3.23
 before 17.11-r0
17.11-r0
postgresql17
Alpine:v3.24
 before 17.11-r0
17.11-r0
Show 157 moreShow less
Affected packages
PackageAffectedFixed
postgresql18
Alpine:v3.23
 before 18.5-r0
18.5-r0
postgresql18
Alpine:v3.24
 before 18.5-r0
18.5-r0
postgresql18
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-contrib
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-docs
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-plperl
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-plpython3
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-private-devel
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-private-libs
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-server
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-server-devel
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-static
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-test
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-test-rpm-macros
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-upgrade
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
postgresql18-upgrade-devel
AlmaLinux:10
From an advisory covering 19 CVEs
 before 18.6-1.el10_2
18.6-1.el10_2
pg_repack
AlmaLinux:9
From an advisory covering 20 CVEs
 before 1.5.3-1.module_el9.8.0+234+5456f35d
1.5.3-1.module_el9.8.0+234+5456f35d
pgaudit
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.0-1.module_el9.8.0+234+5456f35d
18.0-1.module_el9.8.0+234+5456f35d
pgvector
AlmaLinux:9
From an advisory covering 20 CVEs
 before 0.8.1-1.module_el9.8.0+234+5456f35d
0.8.1-1.module_el9.8.0+234+5456f35d
postgis
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.6.1-4.module_el9.8.0+310+22372bcc
3.6.1-4.module_el9.8.0+310+22372bcc
postgis-client
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.6.1-4.module_el9.8.0+310+22372bcc
3.6.1-4.module_el9.8.0+310+22372bcc
postgis-docs
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.6.1-4.module_el9.8.0+310+22372bcc
3.6.1-4.module_el9.8.0+310+22372bcc
postgis-upgrade
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.6.1-4.module_el9.8.0+310+22372bcc
3.6.1-4.module_el9.8.0+310+22372bcc
postgis-utils
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.6.1-4.module_el9.8.0+310+22372bcc
3.6.1-4.module_el9.8.0+310+22372bcc
postgres-decoderbufs
AlmaLinux:9
From an advisory covering 20 CVEs
 before 3.3.1-1.Final.module_el9.8.0+234+5456f35d
3.3.1-1.Final.module_el9.8.0+234+5456f35d
postgresql
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-contrib
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-docs
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-plperl
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-plpython3
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-pltcl
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-private-devel
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-private-libs
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-server
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-server-devel
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-static
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-test
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-test-rpm-macros
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-upgrade
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql-upgrade-devel
AlmaLinux:9
From an advisory covering 20 CVEs
 before 18.6-1.module_el9.8.0+310+22372bcc
18.6-1.module_el9.8.0+310+22372bcc
postgresql17
Alpaquita:25
 17.5-r0 up to 17.11-r0
17.11-r0
postgresql18
Alpaquita:stream
 18.0-r0 up to 18.6-r0
18.6-r0
postgresql
Bitnami
 18.0.0 up to 18.5.0
18.5.0
postgresql-18
Debian:14
 before 18.6-1, plus listed versions
18.0-118.1-118.1-218.2-118.3-1
Show 15 moreShow less
18.4-118~beta1+20250612-118~beta1+20250624-118~beta1+20250701-118~beta1-118~beta2-118~beta3-118~rc1-118~rc1-218~rc1-318~~devel.20250318+g4078da6c478-118~~devel.20250331-118~~devel.20250405-118~~devel.20250421-118~~devel.20250502-1
18.6-1
postgresql18
Mageia:10
From an advisory covering 28 CVEs
 before 18.6-1.mga10
18.6-1.mga10
postgresql15
Mageia:10
From an advisory covering 28 CVEs
 before 15.19-1.mga10
15.19-1.mga10
postgresql15
Mageia:9
From an advisory covering 28 CVEs
 before 15.19-1.mga9
15.19-1.mga9
postgresql18
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-contrib
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-contrib-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-debugsource
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-docs
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-docs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-plperl
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-plperl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-plpython3
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-plpython3-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-pltcl-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-private-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-private-libs
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-private-libs-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-server
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-server-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-server-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-server-devel-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-static
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-test
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-test-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-upgrade
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-upgrade-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-upgrade-devel
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-upgrade-devel-debuginfo
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
postgresql18-test-rpm-macros
Red Hat:enterprise_linux:10.2
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
pg_repack
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:1.5.3-1.module+el9.8.0+23739+1c42644c
0:1.5.3-1.module+el9.8.0+23739+1c42644c
pg_repack-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:1.5.3-1.module+el9.8.0+23739+1c42644c
0:1.5.3-1.module+el9.8.0+23739+1c42644c
pg_repack-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:1.5.3-1.module+el9.8.0+23739+1c42644c
0:1.5.3-1.module+el9.8.0+23739+1c42644c
pgaudit
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.0-1.module+el9.8.0+23739+1c42644c
0:18.0-1.module+el9.8.0+23739+1c42644c
pgaudit-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.0-1.module+el9.8.0+23739+1c42644c
0:18.0-1.module+el9.8.0+23739+1c42644c
pgaudit-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.0-1.module+el9.8.0+23739+1c42644c
0:18.0-1.module+el9.8.0+23739+1c42644c
pgvector
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:0.8.1-1.module+el9.8.0+23739+1c42644c
0:0.8.1-1.module+el9.8.0+23739+1c42644c
pgvector-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:0.8.1-1.module+el9.8.0+23739+1c42644c
0:0.8.1-1.module+el9.8.0+23739+1c42644c
pgvector-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:0.8.1-1.module+el9.8.0+23739+1c42644c
0:0.8.1-1.module+el9.8.0+23739+1c42644c
postgis
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-client
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-client-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-upgrade
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-upgrade-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-utils
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.6.1-4.module+el9.8.0+24879+1364ef12
0:3.6.1-4.module+el9.8.0+24879+1364ef12
postgres-decoderbufs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
postgres-decoderbufs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
postgres-decoderbufs-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
postgresql
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-contrib
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-contrib-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-debugsource
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-docs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-docs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plperl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plperl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plpython3
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plpython3-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-pltcl
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-pltcl-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-private-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-private-libs
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-private-libs-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-server
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-server-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-server-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-server-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-static
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-test
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-test-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-test-rpm-macros
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgrade
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgrade-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgrade-devel
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgrade-devel-debuginfo
Red Hat:enterprise_linux:9::appstream
From an advisory covering 20 CVEs
 before 0:18.6-1.module+el9.8.0+24816+5c11f535
0:18.6-1.module+el9.8.0+24816+5c11f535
postgresql18
Rocky Linux:10
From an advisory covering 19 CVEs
 before 0:18.6-1.el10_2
0:18.6-1.el10_2
pgaudit
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:18.0-1.module+el9.8.0+40158+490b3c67
0:18.0-1.module+el9.8.0+40158+490b3c67
pgaudit
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:18.0-1.module+el9.8.0+40213+f1e225a4
0:18.0-1.module+el9.8.0+40213+f1e225a4
pg_repack
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:1.5.3-1.module+el9.8.0+40213+f1e225a4
0:1.5.3-1.module+el9.8.0+40213+f1e225a4
pg_repack
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:1.5.3-1.module+el9.8.0+40158+490b3c67
0:1.5.3-1.module+el9.8.0+40158+490b3c67
pgvector
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:0.8.1-1.module+el9.8.0+40158+490b3c67
0:0.8.1-1.module+el9.8.0+40158+490b3c67
pgvector
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:0.8.1-1.module+el9.8.0+40213+f1e225a4
0:0.8.1-1.module+el9.8.0+40213+f1e225a4
postgres-decoderbufs
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:3.3.1-1.Final.module+el9.8.0+40213+f1e225a4
0:3.3.1-1.Final.module+el9.8.0+40213+f1e225a4
postgres-decoderbufs
Rocky Linux:9
From an advisory covering 20 CVEs
 before 0:3.3.1-1.Final.module+el9.8.0+40158+490b3c67
0:3.3.1-1.Final.module+el9.8.0+40158+490b3c67
postgresql18
SUSE:Linux Enterprise Server 16.0
From an advisory covering 28 CVEs
 before 18.6-160000.1.1
18.6-160000.1.1
postgresql18
SUSE:Linux Enterprise Server for SAP applications 16.0
From an advisory covering 28 CVEs
 before 18.6-160000.1.1
18.6-160000.1.1
postgresql18
SUSE:Linux Enterprise Server 12 SP5-LTSS
From an advisory covering 28 CVEs
 before 18.6-8.17.1
18.6-8.17.1
postgresql18
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
From an advisory covering 28 CVEs
 before 18.6-8.17.1
18.6-8.17.1
postgresql18
SUSE:Linux Enterprise Module for Basesystem 15 SP7
From an advisory covering 28 CVEs
 before 18.6-150600.13.16.1
18.6-150600.13.16.1
postgresql18
SUSE:Linux Enterprise Module for Package Hub 15 SP7
From an advisory covering 28 CVEs
 before 18.6-150600.13.16.1
18.6-150600.13.16.1
postgresql18
SUSE:Linux Enterprise Module for Server Applications 15 SP7
From an advisory covering 28 CVEs
 before 18.6-150600.13.16.1
18.6-150600.13.16.1
postgresql18
SUSE:Linux Enterprise Server 15 SP6-LTSS
From an advisory covering 28 CVEs
 before 18.6-150600.13.16.1
18.6-150600.13.16.1
postgresql18
SUSE:Linux Enterprise Server for SAP Applications 15 SP6
From an advisory covering 28 CVEs
 before 18.6-150600.13.16.1
18.6-150600.13.16.1
postgresql18
SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise Server 15 SP4-LTSS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise Server 15 SP5-LTSS
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise Server for SAP Applications 15 SP4
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql18
SUSE:Linux Enterprise Server for SAP Applications 15 SP5
From an advisory covering 28 CVEs
 before 18.6-150200.5.17.1
18.6-150200.5.17.1
postgresql-9.3
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
9.3.1-19.3.2-19.3.2-1ubuntu19.3.2-1ubuntu29.3.3-1
Show 24 moreShow less
9.3.3-1bzr19.3.3-1bzr29.3.4-19.3.5-0ubuntu0.14.04.19.3.6-0ubuntu0.14.049.3.7-0ubuntu0.14.049.3.8-0ubuntu0.4.049.3.9-0ubuntu0.14.049.3.10-0ubuntu0.14.049.3.11-0ubuntu0.14.049.3.12-0ubuntu0.14.049.3.13-0ubuntu0.14.049.3.14-0ubuntu0.14.049.3.15-0ubuntu0.14.049.3.16-0ubuntu0.14.049.3.17-0ubuntu0.14.049.3.18-0ubuntu0.14.04.19.3.19-0ubuntu0.14.049.3.20-0ubuntu0.14.049.3.21-0ubuntu0.14.049.3.22-0ubuntu0.14.049.3.23-0ubuntu0.14.049.3.24-0ubuntu0.14.049.3.24-0ubuntu0.14.04+esm1
 None known
postgresql-18
Ubuntu:26.04:LTS
 before 18.6-0ubuntu0.26.04.1, plus listed versions
18.0-118.1-118.1-1ubuntu118.1-1ubuntu218.1-218.3-118.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
postgresql-14
Ubuntu:22.04:LTS
From an advisory covering 30 CVEs
 before 14.24-0ubuntu0.22.04.1, plus listed versions
14.1-1ubuntu114.2-114.2-1ubuntu114.3-0ubuntu0.22.04.114.4-0ubuntu0.22.04.1
Show 16 moreShow less
14.5-0ubuntu0.22.04.114.6-0ubuntu0.22.04.114.7-0ubuntu0.22.04.114.8-0ubuntu0.22.04.114.9-0ubuntu0.22.04.114.10-0ubuntu0.22.04.114.11-0ubuntu0.22.04.114.12-0ubuntu0.22.04.114.13-0ubuntu0.22.04.114.15-0ubuntu0.22.04.114.17-0ubuntu0.22.04.114.18-0ubuntu0.22.04.114.19-0ubuntu0.22.04.114.20-0ubuntu0.22.04.114.22-0ubuntu0.22.04.114.23-0ubuntu0.22.04.1
14.24-0ubuntu0.22.04.1
postgresql-16
Ubuntu:24.04:LTS
From an advisory covering 30 CVEs
 before 16.15-0ubuntu0.24.04.1, plus listed versions
16.0-216.1-116.1-1build116.1-1build316.2-1
Show 13 moreShow less
16.2-1ubuntu216.2-1ubuntu316.2-1ubuntu416.3-0ubuntu0.24.04.116.4-0ubuntu0.24.04.116.4-0ubuntu0.24.04.216.6-0ubuntu0.24.04.116.8-0ubuntu0.24.04.116.9-0ubuntu0.24.04.116.10-0ubuntu0.24.04.116.11-0ubuntu0.24.04.116.13-0ubuntu0.24.04.116.14-0ubuntu0.24.04.1
16.15-0ubuntu0.24.04.1
postgresql-18
Ubuntu:26.04:LTS
From an advisory covering 30 CVEs
 before 18.6-0ubuntu0.26.04.1, plus listed versions
18.0-118.1-118.1-1ubuntu118.1-1ubuntu218.1-218.3-118.4-0ubuntu0.26.04.1
18.6-0ubuntu0.26.04.1
postgresql18
openSUSE:Tumbleweed
From an advisory covering 28 CVEs
 before 18.6-1.1
18.6-1.1
postgresql18
openSUSE:Leap 16.0
From an advisory covering 28 CVEs
 before 18.6-160000.1.1
18.6-160000.1.1
postgresql18-mini
openSUSE:Leap 16.0
From an advisory covering 28 CVEs
 before 18.6-160000.1.1
18.6-160000.1.1

History

History
RecordedChangedSources
affected, facts
affectedOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-16238 is a high vulnerability (CVSS 8.8) in Postgresql, published August 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. Fixed in postgresql15 15.19-r0.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 29 references and the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open