{"id":"CVE-2026-16238","aliases":["ALPINE-CVE-2026-16238","ALSA-2026:67280","ALSA-2026:67848","BELL-CVE-2026-16238","BIT-postgresql-2026-16238","DEBIAN-CVE-2026-16238","EUVD-2026-57848","GHSA-6q3v-qqc9-g2rv","MGASA-2026-0347","RHSA-2026:67280","RHSA-2026:67848","RLSA-2026:67280","RLSA-2026:67848","SUSE-SU-2026:23577-1","SUSE-SU-2026:3942-1","SUSE-SU-2026:4014-1","SUSE-SU-2026:4015-1","UBUNTU-CVE-2026-16238","USN-8653-1","openSUSE-SU-2026:11565-1","openSUSE-SU-2026:21703-1"],"status":"published","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00414,"percentile":0.36192,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-843"],"published":"2026-08-13T13:00:12Z","modified":"2026-11-03T06:32:52Z","fixes":[{"ecosystem":"Alpine:v3.21","package":"postgresql15","fixed_in":["15.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"postgresql15","fixed_in":["15.19-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"postgresql16","fixed_in":["16.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"postgresql16","fixed_in":["16.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"postgresql16","fixed_in":["16.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"postgresql16","fixed_in":["16.15-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"postgresql17","fixed_in":["17.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"postgresql17","fixed_in":["17.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"postgresql17","fixed_in":["17.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"postgresql17","fixed_in":["17.11-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"postgresql18","fixed_in":["18.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"postgresql18","fixed_in":["18.5-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"postgresql17","fixed_in":["17.11-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"postgresql18","fixed_in":["18.6-r0"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"postgresql","fixed_in":["18.5.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postgresql-18","fixed_in":["18.6-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"postgresql-18","fixed_in":["18.6-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.21","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"postgresql16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"postgresql16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"postgresql16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"postgresql16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"postgresql17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"postgresql17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"postgresql17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"postgresql17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.5-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.Final.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"Alpaquita:25","package":"postgresql17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.5-r0"},{"fixed":"17.11-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0-r0"},{"fixed":"18.6-r0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"postgresql","ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.5.0"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"postgresql-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1"}]}],"versions":["18.0-1","18.1-1","18.1-2","18.2-1","18.3-1","18.4-1","18~beta1+20250612-1","18~beta1+20250624-1","18~beta1+20250701-1","18~beta1-1","18~beta2-1","18~beta3-1","18~rc1-1","18~rc1-2","18~rc1-3","18~~devel.20250318+g4078da6c478-1","18~~devel.20250331-1","18~~devel.20250405-1","18~~devel.20250421-1","18~~devel.20250502-1"]},{"source":"osv","ecosystem":"Mageia:10","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.mga10"}]}],"bundled":28},{"source":"osv","ecosystem":"Mageia:10","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-1.mga10"}]}],"bundled":28},{"source":"osv","ecosystem":"Mageia:9","package":"postgresql15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.19-1.mga9"}]}],"bundled":28},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-contrib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-docs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-plperl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-plpython3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-pltcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-private-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-server-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-upgrade-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:10","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.el10_2"}]}],"bundled":19},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-160000.1.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-160000.1.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-8.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-8.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150600.13.16.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150600.13.16.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150600.13.16.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150600.13.16.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150600.13.16.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-150200.5.17.1"}]}],"bundled":28},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"postgresql-9.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.3.1-1","9.3.2-1","9.3.2-1ubuntu1","9.3.2-1ubuntu2","9.3.3-1","9.3.3-1bzr1","9.3.3-1bzr2","9.3.4-1","9.3.5-0ubuntu0.14.04.1","9.3.6-0ubuntu0.14.04","9.3.7-0ubuntu0.14.04","9.3.8-0ubuntu0.4.04","9.3.9-0ubuntu0.14.04","9.3.10-0ubuntu0.14.04","9.3.11-0ubuntu0.14.04","9.3.12-0ubuntu0.14.04","9.3.13-0ubuntu0.14.04","9.3.14-0ubuntu0.14.04","9.3.15-0ubuntu0.14.04","9.3.16-0ubuntu0.14.04","9.3.17-0ubuntu0.14.04","9.3.18-0ubuntu0.14.04.1","9.3.19-0ubuntu0.14.04","9.3.20-0ubuntu0.14.04","9.3.21-0ubuntu0.14.04","9.3.22-0ubuntu0.14.04","9.3.23-0ubuntu0.14.04","9.3.24-0ubuntu0.14.04","9.3.24-0ubuntu0.14.04+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postgresql-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-0ubuntu0.26.04.1"}]}],"versions":["18.0-1","18.1-1","18.1-1ubuntu1","18.1-1ubuntu2","18.1-2","18.3-1","18.4-0ubuntu0.26.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postgresql-14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.24-0ubuntu0.22.04.1"}]}],"versions":["14.1-1ubuntu1","14.2-1","14.2-1ubuntu1","14.3-0ubuntu0.22.04.1","14.4-0ubuntu0.22.04.1","14.5-0ubuntu0.22.04.1","14.6-0ubuntu0.22.04.1","14.7-0ubuntu0.22.04.1","14.8-0ubuntu0.22.04.1","14.9-0ubuntu0.22.04.1","14.10-0ubuntu0.22.04.1","14.11-0ubuntu0.22.04.1","14.12-0ubuntu0.22.04.1","14.13-0ubuntu0.22.04.1","14.15-0ubuntu0.22.04.1","14.17-0ubuntu0.22.04.1","14.18-0ubuntu0.22.04.1","14.19-0ubuntu0.22.04.1","14.20-0ubuntu0.22.04.1","14.22-0ubuntu0.22.04.1","14.23-0ubuntu0.22.04.1"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"postgresql-16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-0ubuntu0.24.04.1"}]}],"versions":["16.0-2","16.1-1","16.1-1build1","16.1-1build3","16.2-1","16.2-1ubuntu2","16.2-1ubuntu3","16.2-1ubuntu4","16.3-0ubuntu0.24.04.1","16.4-0ubuntu0.24.04.1","16.4-0ubuntu0.24.04.2","16.6-0ubuntu0.24.04.1","16.8-0ubuntu0.24.04.1","16.9-0ubuntu0.24.04.1","16.10-0ubuntu0.24.04.1","16.11-0ubuntu0.24.04.1","16.13-0ubuntu0.24.04.1","16.14-0ubuntu0.24.04.1"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postgresql-18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-0ubuntu0.26.04.1"}]}],"versions":["18.0-1","18.1-1","18.1-1ubuntu1","18.1-1ubuntu2","18.1-2","18.3-1","18.4-0ubuntu0.26.04.1"],"bundled":30},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"postgresql18","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-160000.1.1"}]}],"bundled":28},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"postgresql18-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-160000.1.1"}]}],"bundled":28}],"products":[{"vendor":"postgresql","product":"postgresql"}],"references":[{"url":"https://www.postgresql.org/support/security/CVE-2026-16238/","tags":["Vendor Advisory","advisory","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16238","tags":["web","advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-16238"},{"url":"https://github.com/advisories/GHSA-6q3v-qqc9-g2rv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-16238","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67280","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14662","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14664","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14668","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14670","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14671","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14676","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14677","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14679","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14680","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15741","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15742","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16238","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16239","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18408","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19385","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6464","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6471","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6476","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477437","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515302","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515307","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515308","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515311","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515313","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515314","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515316","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515317","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515319","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515328","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-67280.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73515","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515303","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515306","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515321","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515322","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515325","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515326","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515332","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515434","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-67848.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-16238","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-16238","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0347.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36165","tags":["report"]},{"url":"https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/","tags":["web","report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515324","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515332","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67280.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6464","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6464/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6471","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6471/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6476","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6476/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14662","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14662/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14664","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14664/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14668","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14668/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14669","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14669/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14670","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14670/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14671","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14671/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14676","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14676/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14677","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14677/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14679","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14679/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14680","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14680/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15741","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-15741/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15742","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-15742/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16238","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16239","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-16239/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18408","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-18408/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19385","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-19385/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515434","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67848.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73515","tags":["advisory"]},{"url":"https://gitea.osgeo.org/postgis/postgis/raw/tag/3.7.0beta2/NEWS","tags":["article"]},{"url":"https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/postgis-0beta2-out-of-bounds-read-via-flatgeobuf-buffer","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67280","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67848","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623577-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1275001","tags":["report"]},{"url":"https://bugzilla.suse.com/1275002","tags":["report"]},{"url":"https://bugzilla.suse.com/1275042","tags":["report"]},{"url":"https://bugzilla.suse.com/1275043","tags":["report"]},{"url":"https://bugzilla.suse.com/1275044","tags":["report"]},{"url":"https://bugzilla.suse.com/1275046","tags":["report"]},{"url":"https://bugzilla.suse.com/1275047","tags":["report"]},{"url":"https://bugzilla.suse.com/1275048","tags":["report"]},{"url":"https://bugzilla.suse.com/1275049","tags":["report"]},{"url":"https://bugzilla.suse.com/1275050","tags":["report"]},{"url":"https://bugzilla.suse.com/1275051","tags":["report"]},{"url":"https://bugzilla.suse.com/1275052","tags":["report"]},{"url":"https://bugzilla.suse.com/1275053","tags":["report"]},{"url":"https://bugzilla.suse.com/1275054","tags":["report"]},{"url":"https://bugzilla.suse.com/1275055","tags":["report"]},{"url":"https://bugzilla.suse.com/1275056","tags":["report"]},{"url":"https://bugzilla.suse.com/1275057","tags":["report"]},{"url":"https://bugzilla.suse.com/1275058","tags":["report"]},{"url":"https://bugzilla.suse.com/1275059","tags":["report"]},{"url":"https://bugzilla.suse.com/1275060","tags":["report"]},{"url":"https://bugzilla.suse.com/1275061","tags":["report"]},{"url":"https://bugzilla.suse.com/1275062","tags":["report"]},{"url":"https://bugzilla.suse.com/1275063","tags":["report"]},{"url":"https://bugzilla.suse.com/1275064","tags":["report"]},{"url":"https://bugzilla.suse.com/1275065","tags":["report"]},{"url":"https://bugzilla.suse.com/1275066","tags":["report"]},{"url":"https://bugzilla.suse.com/1275067","tags":["report"]},{"url":"https://bugzilla.suse.com/1275068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14670","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-14681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-15742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16238","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-16241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18024","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-18408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-19385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-6471","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263942-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264014-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264015-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-16238","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8653-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-8714","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6469","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6470","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6471","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-6473","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14662","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14663","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14664","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14666","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14668","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14669","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14670","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14672","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14673","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14676","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14677","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14679","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14680","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-14681","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-15742","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-16239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-16241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-18024","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-18408","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-19385","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-16238","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:00:12.45Z","modified":"2026-08-29T23:07:28.49Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:20:11.24076Z"}],"euvd":[{"id":"EUVD-2026-57848","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:00:12Z","modified":"2026-08-29T23:07:28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:01:21.466916Z"}],"ghsa":[{"id":"GHSA-6q3v-qqc9-g2rv","title":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute...","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.5 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T15:34:36Z","modified":"2026-08-13T15:34:36Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T15:10:24.70819Z"}],"nvd":[{"id":"CVE-2026-16238","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:17:46.383Z","modified":"2026-08-29T23:17:19.083Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-843"],"updated_at":"2026-11-02T14:12:37.217486Z"}],"osv":[{"id":"ALPINE-CVE-2026-16238","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:17:46.383Z","modified":"2026-11-03T06:32:52.91955149Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"BELL-CVE-2026-16238","status":"published","published":"2026-08-18T06:06:09.148227Z","modified":"2026-08-22T07:15:08.76328609Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:23.037038Z"},{"id":"DEBIAN-CVE-2026-16238","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:17:46.383Z","modified":"2026-10-01T03:02:26.691297029Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"RHSA-2026:67280","title":"Red Hat Security Advisory: postgresql18 security update","status":"published","published":"2026-09-15T10:17:05Z","modified":"2026-10-19T10:05:42Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67848","title":"Red Hat Security Advisory: postgresql:18 security update","status":"published","published":"2026-09-17T10:18:01Z","modified":"2026-10-19T10:05:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:67280","title":"Important: postgresql18 security update","description":"PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n\n* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n\n* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n\n* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n\n* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n\n* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n\n* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n\n* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n\n* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n\n* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n\n* postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n\n* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n\n* postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n\n* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n\n* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T12:08:56.876794Z","modified":"2026-09-15T12:30:03.117421744Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67848","title":"Important: postgresql:18 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n\n* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n\n* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n\n* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n\n* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n\n* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n\n* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n\n* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n\n* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n\n* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n\n* postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n\n* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n\n* postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n\n* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n\n* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-16T18:04:51.734663Z","modified":"2026-09-16T18:24:46.969630077Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"UBUNTU-CVE-2026-16238","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-13T13:17:00Z","modified":"2026-09-02T19:35:35.587531117Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"},{"id":"ALSA-2026:67280","title":"Important: postgresql18 security update","description":"PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n  * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-29T11:30:42.321311006Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67848","title":"Important: postgresql:18 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n  * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:32:32.067480091Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"BIT-postgresql-2026-16238","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","description":"Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values.  Within major version 18, minor versions before PostgreSQL 18.6 are affected.  Versions before PostgreSQL 18 are unaffected.","status":"published","published":"2026-08-19T08:52:49.623Z","modified":"2026-09-08T08:48:04.845195805Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"MGASA-2026-0347","title":"Updated postgresql18 \u0026 postgresql15 packages fix security vulnerabilities","description":"psql COPY FROM STDIN early failure processes data lines as psql\ncommands. (CVE-2026-6464)\nALTER TABLE ALTER TYPE resets extended statistics ownership.\n(CVE-2026-6469)\nFails to check type USAGE privilege. (CVE-2026-6470)\nLogical decoding can dlopen arbitrary file. (CVE-2026-6471)\ntsvector and tsquery undersize allocations, via integer wraparound.\n(CVE-2026-14662)\npgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and\ndecrypts from cleartext. (CVE-2026-14663)\nRegexp heap buffer overflow executes arbitrary code. (CVE-2026-14664)\nRow security caching disregards role modifications. (CVE-2026-14666)\nctid type confusion in selectivity estimator discloses derivative of\narbitrary read. (CVE-2026-14668)\nto_char heap buffer overflow executes arbitrary code. (CVE-2026-14669)\nplperl tied object heap buffer overflow executes arbitrary code.\n(CVE-2026-14670)\nrefint plan cache type confusion executes arbitrary code.\n(CVE-2026-14671)\nObservable response discrepancy with non-default scram_iterations\nprovides user existence oracle. (CVE-2026-14672)\namcheck does not clear untrusted search path. (CVE-2026-14673)\npg_stat_statements heap buffer overflow executes arbitrary code.\n(CVE-2026-14676)\n32-bit pltcl and plperl undersize allocations, via integer wraparound.\n(CVE-2026-14677)\npg_trgm picksplit reads past end of buffer. (CVE-2026-14678)\nStack buffer overflow in argument match writes 0x0 and 0x1 to server\nmemory. (CVE-2026-14679)\nType confusion via \"internal\" arguments. (CVE-2026-14680)\nImproper enforcement of GSSAPI encryption when coupled with SSL.\n(CVE-2026-14681)\nExpression deparse allows SQL injection via EXTRACT argument.\n(CVE-2026-15741)\nfuzzystrmatch writes effectively-arbitrary addresses, via integer\nwraparound. (CVE-2026-15742)\nType confusion in pg_restore_attribute_stats() executes arbitrary code.\n(CVE-2026-16238)\nType confusion in cursor CLOSE + DECLARE executes arbitrary code.\n(CVE-2026-16239)\nECPG integer underflow can crash the client. (CVE-2026-16241)\nascii() function reads past end of buffer. (CVE-2026-18024)\npsql \\unrestrict lets superuser of pg_dump origin server execute\narbitrary code in psql client. (CVE-2026-18408)\npg_dump heap buffer overflow executes arbitrary code. (CVE-2026-19385)\n","status":"published","published":"2026-08-31T16:22:02Z","modified":"2026-08-31T16:41:22.87871239Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11565-1","title":"libecpg6-18.6-1.1 on GA media","description":"These are all security issues fixed in the libecpg6-18.6-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-21T00:00:00Z","modified":"2026-08-22T18:23:35.172985758Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21703-1","title":"Security update for postgresql18","description":"This update for postgresql18 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user existence\n  oracle (bsc#1275062).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via \"internal\" arguments (bsc#1275056).\n- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql18:\n\n- Let `llvmjit-devel` require the `llc` and `clang` binaries to fix build of extensions on SLE-16 and newer.\n- Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.\n- Update to version 18.6:\n  * https://www.postgresql.org/docs/18/release-18-6.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/\n","status":"published","published":"2026-08-30T15:29:24Z","modified":"2026-08-31T18:15:04.195139093Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"SUSE-SU-2026:23577-1","title":"Security update for postgresql18","description":"This update for postgresql18 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user existence\n  oracle (bsc#1275062).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via \"internal\" arguments (bsc#1275056).\n- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql18:\n\n- Let `llvmjit-devel` require the `llc` and `clang` binaries to fix build of extensions on SLE-16 and newer.\n- Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.\n- Update to version 18.6:\n  * https://www.postgresql.org/docs/18/release-18-6.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/\n","status":"published","published":"2026-08-30T15:28:34Z","modified":"2026-09-29T18:23:09.391799802Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3942-1","title":"Security update for postgresql18","description":"This update for postgresql18 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user existence\n  oracle (bsc#1275062).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).\n- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql18:\n\n- Update to version 18.6:\n  * https://www.postgresql.org/docs/18/release-18-6.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/\n","status":"published","published":"2026-09-03T07:34:58Z","modified":"2026-09-10T18:23:21.572389423Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4014-1","title":"Security update for postgresql18","description":"This update for postgresql18 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user existence\n  oracle (bsc#1275062).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).\n- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql18:\n\n- Update to version 18.6:\n  * https://www.postgresql.org/docs/18/release-18-6.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/\n","status":"published","published":"2026-09-07T07:36:31Z","modified":"2026-09-13T18:23:15.247483213Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4015-1","title":"Security update for postgresql18","description":"This update for postgresql18 fixes the following issues:\n\n- CVE-2026-6464: `psql` `COPY FROM STDIN` early failure processes data lines as `psql` commands (bsc#1275046).\n- CVE-2026-6469: `ALTER TABLE ALTER TYPE` resets extended statistics ownership (bsc#1275044).\n- CVE-2026-6470: failure to check type `USAGE` privilege (bsc#1275043).\n- CVE-2026-6471: logical decoding can `dlopen` arbitrary file (bsc#1275042).\n- CVE-2026-14662: `tsvector` and `tsquery` undersize allocations, via integer wraparound (bsc#1275001).\n- CVE-2026-14663: `pgcrypto`, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext\n  (bsc#1275002).\n- CVE-2026-14664: `regexp` heap buffer overflow executes arbitrary code (bsc#1275068).\n- CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).\n- CVE-2026-14668: `ctid` type confusion in selectivity estimator discloses derivative of arbitrary read\n  (bsc#1275066).\n- CVE-2026-14669: `to_char` heap buffer overflow executes arbitrary code (bsc#1275065).\n- CVE-2026-14670: `plperl` tied object heap buffer overflow executes arbitrary code (bsc#1275064).\n- CVE-2026-14671: `refint` plan cache type confusion executes arbitrary code (bsc#1275063).\n- CVE-2026-14672:  observable response discrepancy with non-default `scram_iterations` provides user existence\n  oracle (bsc#1275062).\n- CVE-2026-14673: `amcheck` does not clear untrusted search path (bsc#1275061).\n- CVE-2026-14676: `pg_stat_statements` heap buffer overflow executes arbitrary code (bsc#1275060).\n- CVE-2026-14677: 32-bit `pltcl` and `plperl` undersize allocations, via integer wraparound (bsc#1275059).\n- CVE-2026-14678: `pg_trgm` `picksplit` reads past end of buffer (bsc#1275058).\n- CVE-2026-14679: stack buffer overflow in argument match writes `0x0` and `0x1` to server memory (bsc#1275057).\n- CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).\n- CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).\n- CVE-2026-15741: expression deparse allows SQL injection via `EXTRACT` argument (bsc#1275054).\n- CVE-2026-15742: `fuzzystrmatch` writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).\n- CVE-2026-16238: type confusion in `pg_restore_attribute_stats()` executes arbitrary code (bsc#1275052).\n- CVE-2026-16239: type confusion in cursor `CLOSE + DECLARE` executes arbitrary code (bsc#1275051).\n- CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).\n- CVE-2026-18024: `ascii()` function reads past end of buffer (bsc#1275049).\n- CVE-2026-18408: `psql` `\\unrestrict` lets superuser of `pg_dump` origin server execute arbitrary code in `psql`\n  client (bsc#1275048).\n- CVE-2026-19385: `pg_dump` heap buffer overflow executes arbitrary code (bsc#1275047).\n\nChanges for postgresql18:\n\n- Update to version 18.6:\n  * https://www.postgresql.org/docs/18/release-18-6.html\n  * https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/\n","status":"published","published":"2026-09-07T07:37:23Z","modified":"2026-09-13T18:23:15.459905089Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8653-1","title":"postgresql-14, postgresql-16, postgresql-18 vulnerabilities","description":"It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when\nan early failure occurred. An authenticated user could possibly use this\nissue to execute arbitrary SQL commands. (CVE-2026-6464)\n\nIt was discovered that PostgreSQL incorrectly reset extended statistics\nownership during ALTER TABLE ALTER TYPE operations. An attacker could\npossibly use this issue to obtain sensitive information or gain unintended\nprivileges. (CVE-2026-6469)\n\nIt was discovered that PostgreSQL failed to check the USAGE privilege on\ntypes. An authenticated user could possibly use this issue to obtain\nsensitive information. (CVE-2026-6470)\n\nIt was discovered that PostgreSQL logical decoding could load arbitrary\nshared libraries. An authenticated user could possibly use this issue to\nexecute arbitrary code. (CVE-2026-6471)\n\nIt was discovered that PostgreSQL had integer wraparound issues in tsvector\nand tsquery allocations. An authenticated user could possibly use this\nissue to execute arbitrary code. (CVE-2026-14662)\n\nIt was discovered that PostgreSQL pgcrypto silently used cleartext when\nOpenSSL-disabled ciphers were requested. An authenticated user could\npossibly use this issue to obtain sensitive information. (CVE-2026-14663)\n\nIt was discovered that PostgreSQL had a heap buffer overflow in regular\nexpression processing. An authenticated user could possibly use this issue\nto execute arbitrary code. (CVE-2026-14664)\n\nIt was discovered that PostgreSQL row security policies were not properly\ninvalidated when roles were modified. An attacker could possibly use this\nissue to bypass intended row security restrictions. (CVE-2026-14666)\n\nIt was discovered that PostgreSQL had a type confusion issue in the\nselectivity estimator involving ctid. An authenticated user could possibly\nuse this issue to obtain sensitive information. (CVE-2026-14668)\n\nIt was discovered that PostgreSQL had a heap buffer overflow in the to_char\nfunction. An authenticated user could possibly use this issue to execute\narbitrary code. (CVE-2026-14669)\n\nIt was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl\ntied object handling. An authenticated user could possibly use this issue\nto execute arbitrary code. (CVE-2026-14670)\n\nIt was discovered that PostgreSQL had a type confusion issue in the\nreferential integrity plan cache. An authenticated user could possibly use\nthis issue to execute arbitrary code. (CVE-2026-14671)\n\nIt was discovered that PostgreSQL had an observable response discrepancy\nwhen non-default scram_iterations were used. A remote attacker could\npossibly use this issue to enumerate valid usernames. This issue only\naffected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-14672)\n\nIt was discovered that PostgreSQL amcheck did not clear untrusted search\npaths. An authenticated user could possibly use this issue to execute\narbitrary code. (CVE-2026-14673)\n\nIt was discovered that PostgreSQL had a heap buffer overflow in\npg_stat_statements. An authenticated user could possibly use this issue to\nexecute arbitrary code. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-14676)\n\nIt was discovered that PostgreSQL had integer wraparound issues in PL/Tcl\nand PL/Perl allocations on 32-bit systems. An authenticated user could\npossibly use this issue to execute arbitrary code. (CVE-2026-14677)\n\nIt was discovered that PostgreSQL pg_trgm read past the end of a buffer\nduring picksplit operations. An authenticated user could possibly use this\nissue to obtain sensitive information. (CVE-2026-14678)\n\nIt was discovered that PostgreSQL had a stack buffer overflow in argument\nmatching. An authenticated user could possibly use this issue to corrupt\nserver memory. (CVE-2026-14679)\n\nIt was discovered that PostgreSQL had a type confusion issue when functions\nused internal arguments. An authenticated user could possibly use this\nissue to execute arbitrary code. (CVE-2026-14680)\n\nIt was discovered that PostgreSQL did not properly enforce GSSAPI\nencryption when used together with SSL. An attacker could possibly use this\nissue to perform a machine-in-the-middle attack and obtain sensitive\ninformation. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14681)\n\nIt was discovered that PostgreSQL allowed SQL injection through EXTRACT\narguments during expression deparsing. An authenticated user could possibly\nuse this issue to perform SQL injection attacks. (CVE-2026-15741)\n\nIt was discovered that PostgreSQL fuzzystrmatch had integer wraparound\nissues that could write to arbitrary addresses. An authenticated user could\npossibly use this issue to execute arbitrary code. (CVE-2026-15742)\n\nIt was discovered that PostgreSQL had a type confusion issue in\npg_restore_attribute_stats(). An authenticated user could possibly use this\nissue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS.\n(CVE-2026-16238)\n\nIt was discovered that PostgreSQL had a type confusion issue when handling\ncursor CLOSE and DECLARE operations. An authenticated user could possibly\nuse this issue to execute arbitrary code. (CVE-2026-16239)\n\nIt was discovered that PostgreSQL had an integer underflow in the ECPG\nclient library. An attacker could possibly use this issue to cause\nPostgreSQL to crash, resulting in a denial of service. (CVE-2026-16241)\n\nIt was discovered that PostgreSQL had an out-of-bounds read in the ascii()\nfunction. An authenticated user could possibly use this issue to obtain\nsensitive information. (CVE-2026-18024)\n\nIt was discovered that the psql \\unrestrict command allowed the superuser\nof a pg_dump origin server to execute arbitrary code in the psql client. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-18408)\n\nIt was discovered that PostgreSQL pg_dump had a heap buffer overflow. An\nattacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-19385)","status":"published","published":"2026-08-20T11:42:58Z","modified":"2026-08-20T23:44:58.684078119Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}