{"id":"CVE-2026-73515","aliases":["ALSA-2026:65899","ALSA-2026:67166","ALSA-2026:67491","ALSA-2026:67848","BIT-postgis-2026-73515","DEBIAN-CVE-2026-73515","EUVD-2026-58108","GHSA-qv7r-wgc7-6mc6","MGASA-2026-0524","RHSA-2026:65899","RHSA-2026:67166","RHSA-2026:67491","RHSA-2026:67848","RLSA-2026:65899","RLSA-2026:67166","RLSA-2026:67491","RLSA-2026:67848","RLSA-2026:97875","UBUNTU-CVE-2026-73515"],"status":"published","title":"PostGIS \u003c 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00566,"percentile":0.47438,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2026-08-13T15:37:09Z","modified":"2026-11-11T00:30:02Z","fixes":[{"ecosystem":"AlmaLinux:10","package":"postgis","fixed_in":["3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgis-client","fixed_in":["3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgis-docs","fixed_in":["3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgis-upgrade","fixed_in":["3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgis-utils","fixed_in":["3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql18-postgis","fixed_in":["3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-client","fixed_in":["3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-docs","fixed_in":["3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-upgrade","fixed_in":["3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-utils","fixed_in":["3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"postgis","fixed_in":["3.7.0"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"postgis","fixed_in":["3.7.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"postgis","fixed_in":["3.6.4-1.mga10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-client","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-client-debuginfo","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-debuginfo","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-docs","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-upgrade","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-upgrade-debuginfo","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-utils","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis-debuginfo","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis-debugsource","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-client","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-client-debuginfo","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-debuginfo","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-debugsource","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-docs","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-upgrade","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-upgrade-debuginfo","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-utils","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"postgresql16-postgis","fixed_in":["0:3.5.3-4.el10_2.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"postgresql18-postgis","fixed_in":["0:3.5.3-1.el10_2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"postgresql18-postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.module_el9.6.0+146+c54fdeca"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0-1.module_el9.4.0+66+eb9878bc"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.2-2.module_el9.6.0+167+4e561146"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.3-6.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.Final.module_el9.4.0+66+eb9878bc"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el9.8.0+311+c39b793b"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.3-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.0-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.1-1.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.1-4.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.1-1.Final.module_el9.8.0+234+5456f35d"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"AlmaLinux:9","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.6-1.module_el9.8.0+310+22372bcc"}]}],"bundled":20},{"source":"osv","ecosystem":"Bitnami","package":"postgis","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.7.0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.2+dfsg-1","3.3.3+dfsg-1","3.3.3+dfsg-1~exp1","3.3.3+dfsg-2","3.3.3+dfsg-3","3.3.3+dfsg-4","3.3.3+dfsg-5","3.3.4+dfsg-1","3.4.0+dfsg-1","3.4.0+dfsg-2","3.4.0+dfsg-2~exp1","3.4.0+dfsg-3","3.4.0+dfsg-4","3.4.0~beta1+dfsg-1~exp1","3.4.0~beta1+dfsg-1~exp2","3.4.0~beta1+dfsg-1~exp3","3.4.0~beta1+dfsg-1~exp4","3.4.0~beta1+dfsg-1~exp5","3.4.0~beta1+dfsg-1~exp6","3.4.0~beta1+dfsg-1~exp7","3.4.0~beta2+dfsg-1~exp1","3.4.0~rc1+dfsg-1~exp1","3.4.0~rc2+dfsg-1~exp1","3.4.0~rc2+dfsg-1~exp2","3.4.0~rc3+dfsg-1~exp1","3.4.0~rc4+dfsg-1~exp1","3.4.1+dfsg-1","3.4.1+dfsg-1~exp1","3.4.2+dfsg-1","3.4.2+dfsg-2","3.4.3+dfsg-1","3.4.3+dfsg-2","3.4.3+dfsg-2~exp1","3.5.0+dfsg-1","3.5.0~alpha1+dfsg-1~exp1","3.5.0~alpha2+dfsg-1~exp1","3.5.0~alpha2+dfsg-1~exp2","3.5.0~alpha2+dfsg-1~exp3","3.5.0~beta1+dfsg-1~exp1","3.5.0~beta1+dfsg-1~exp2","3.5.0~beta1+dfsg-1~exp3","3.5.0~beta1+dfsg-1~exp4","3.5.0~rc1+dfsg-1~exp1","3.5.1+dfsg-1","3.5.2+dfsg-1","3.5.3+dfsg-1","3.5.3+dfsg-1~exp1","3.5.3+dfsg-2","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.0+dfsg-3","3.6.0~alpha1+dfsg-1~exp1","3.6.0~beta1+dfsg-1~exp1","3.6.0~rc1+dfsg-1~exp1","3.6.0~rc2+dfsg-1~exp1","3.6.1+dfsg-1","3.6.1+dfsg-1~exp1","3.6.2+dfsg-1","3.6.3+dfsg-1","3.6.4+dfsg-1","3.6.4+dfsg-2","3.7.0+dfsg-1","3.7.0~alpha1+dfsg-1~exp1","3.7.0~alpha1+dfsg-1~exp2","3.7.0~beta1+dfsg-1~exp1","3.7.0~beta2+dfsg-1~exp1","3.7.0~rc1+dfsg-1~exp1","3.7.0~rc2+dfsg-1~exp1","3.7.0~rc3+dfsg-1~exp1"]},{"source":"osv","ecosystem":"Debian:13","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.2+dfsg-1","3.5.3+dfsg-1","3.5.3+dfsg-1~exp1","3.5.3+dfsg-2","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.0+dfsg-3","3.6.0~alpha1+dfsg-1~exp1","3.6.0~beta1+dfsg-1~exp1","3.6.0~rc1+dfsg-1~exp1","3.6.0~rc2+dfsg-1~exp1","3.6.1+dfsg-1","3.6.1+dfsg-1~exp1","3.6.2+dfsg-1","3.6.3+dfsg-1","3.6.4+dfsg-1","3.6.4+dfsg-2","3.7.0+dfsg-1","3.7.0~alpha1+dfsg-1~exp1","3.7.0~alpha1+dfsg-1~exp2","3.7.0~beta1+dfsg-1~exp1","3.7.0~beta2+dfsg-1~exp1","3.7.0~rc1+dfsg-1~exp1","3.7.0~rc2+dfsg-1~exp1","3.7.0~rc3+dfsg-1~exp1"]},{"source":"osv","ecosystem":"Debian:14","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.0+dfsg-1"}]}],"versions":["3.5.2+dfsg-1","3.5.3+dfsg-1","3.5.3+dfsg-1~exp1","3.5.3+dfsg-2","3.6.0+dfsg-1","3.6.0+dfsg-2","3.6.0+dfsg-3","3.6.0~alpha1+dfsg-1~exp1","3.6.0~beta1+dfsg-1~exp1","3.6.0~rc1+dfsg-1~exp1","3.6.0~rc2+dfsg-1~exp1","3.6.1+dfsg-1","3.6.1+dfsg-1~exp1","3.6.2+dfsg-1","3.6.3+dfsg-1","3.6.4+dfsg-1","3.6.4+dfsg-2","3.7.0~alpha1+dfsg-1~exp1","3.7.0~alpha1+dfsg-1~exp2","3.7.0~beta1+dfsg-1~exp1","3.7.0~beta2+dfsg-1~exp1","3.7.0~rc1+dfsg-1~exp1","3.7.0~rc2+dfsg-1~exp1","3.7.0~rc3+dfsg-1~exp1"]},{"source":"osv","ecosystem":"Mageia:10","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.4-1.mga10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql16-postgis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:10.2","package":"postgresql18-postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.2-2.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.2-2.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.2-2.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+24839+3a67b9ca"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+24090+8f0ee565"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+24803+9dca000b"}]}],"bundled":17},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pg_repack-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgaudit-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"pgvector-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-client-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgis-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.6.1-4.module+el9.8.0+24879+1364ef12"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgres-decoderbufs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+23739+1c42644c"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-contrib-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-docs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plperl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-plpython3-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-pltcl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-private-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-server-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-test-rpm-macros","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"postgresql-upgrade-devel-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.6-1.module+el9.8.0+24816+5c11f535"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:10","package":"postgresql16-postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-4.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"postgresql18-postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-1.el10_2.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+40159+adcaa225"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+40212+d6f50005"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+40212+d6f50005"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+40159+adcaa225"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.2-2.module+el9.8.0+40159+adcaa225"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.2-2.module+el9.8.0+40212+d6f50005"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+40159+adcaa225"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+40212+d6f50005"}]}],"bundled":17},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:18.0-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.3-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgvector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-1.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+40213+f1e225a4"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.3.1-1.Final.module+el9.8.0+40158+490b3c67"}]}],"bundled":20},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+40212+d6f50005"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pgaudit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.0-1.module+el9.8.0+40159+adcaa225"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+40212+d6f50005"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"pg_repack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.5.1-1.module+el9.8.0+40159+adcaa225"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.3-6.module+el9.8.0+40320+f6f9ed3c"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+40212+d6f50005"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgres-decoderbufs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.4.0-1.Final.module+el9.8.0+40159+adcaa225"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:9","package":"postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.15-1.module+el9.8.0+40320+f6f9ed3c"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.8+dfsg-4","2.2.0+dfsg-1","2.2.0+dfsg-3","2.2.1+dfsg-1","2.2.1+dfsg-2","2.2.1+dfsg-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.3+dfsg-1","2.4.2+dfsg-1","2.4.2+dfsg-2ubuntu2","2.4.2+dfsg-3","2.4.3+dfsg-2","2.4.3+dfsg-3","2.4.3+dfsg-4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.5.3+dfsg-1","3.0.0+dfsg-2ubuntu1","3.0.0+dfsg-6ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.1+dfsg-1","3.1.4+dfsg-3ubuntu2","3.2.0+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.3.3+dfsg-2ubuntu1","3.4.0+dfsg-4ubuntu1","3.4.1+dfsg-1ubuntu1","3.4.2+dfsg-1ubuntu1","3.4.2+dfsg-1ubuntu2","3.4.2+dfsg-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.6.2+dfsg-1","3.6.4+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"postgis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.5.3+dfsg-2build1","3.6.1+dfsg-1build1","3.6.2+dfsg-1"]}],"products":[{"vendor":"postgis","product":"postgis"}],"references":[{"url":"https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more/","tags":["technical-description","exploit","web","evidence","article"]},{"url":"https://gitea.osgeo.org/postgis/postgis/raw/tag/3.7.0beta2/NEWS","tags":["release-notes","web","advisory","article"]},{"url":"https://www.vulncheck.com/advisories/postgis-0beta2-out-of-bounds-read-via-flatgeobuf-buffer","tags":["third-party-advisory","web","advisory","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73515","tags":["web","advisory"]},{"url":"https://mehmetince.net/part-1-6-systemic-risks-in-the-managed-postgresql-industry-extension-risks-are-real-exploiting-postgis-memory-corruption-bug-at-neondb-supabase-and-many-more"},{"url":"https://github.com/advisories/GHSA-qv7r-wgc7-6mc6"},{"url":"https://access.redhat.com/errata/RHSA-2026:65899","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-73515","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515434","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-65899.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67166","tags":["advisory"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-67166.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67491","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14662","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14664","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14668","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14669","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14670","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14671","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14677","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14679","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14680","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15741","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-15742","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16239","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-18408","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-19385","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6464","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6471","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515302","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515307","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515308","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515311","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515313","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515314","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515316","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515317","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515328","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-67491.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67848","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-14676","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-16238","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-6476","tags":["report"]},{"url":"https://bugzilla.redhat.com/2477437","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515303","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515306","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515319","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515321","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515322","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515324","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515325","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515326","tags":["report"]},{"url":"https://bugzilla.redhat.com/2515332","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-67848.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73515.json","tags":["advisory"]},{"url":"https://github.com/postgis/postgis","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-73515","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0524.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36406","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73KG56KPJQTU3M7K3HOTNQUAINTCIRDD/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515434","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_65899.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-73515","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67166.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515311","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515314","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515317","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515322","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515326","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515332","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67491.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6464","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6464","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6464/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6471","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6471","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6471/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14662","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14662/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14664","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14664/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14668","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14668","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14668/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14669","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14669","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14669/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14670","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14670","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14670/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14671","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14671/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14677","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14677/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14679","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14679","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14679/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14680","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14680/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15741","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15741","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-15741/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-15742","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15742","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-15742/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16239","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16239","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-16239/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-18408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-18408","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-18408/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19385","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19385","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-19385/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2477437","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2515324","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67848.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-6476","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6476","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-6476/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-14676","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14676","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-14676/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-16238","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16238","tags":["advisory"]},{"url":"https://www.postgresql.org/support/security/CVE-2026-16238/","tags":["article"]},{"url":"https://errata.rockylinux.org/RLSA-2026:65899","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67166","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67491","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:67848","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:97875","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2544842","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2026:97875","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-73515","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-73515","title":"PostGIS \u003c 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T15:37:09.289Z","modified":"2026-08-14T16:52:29.396Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-58108","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T15:37:09Z","modified":"2026-08-14T16:52:29Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:53.90055Z"}],"ghsa":[{"id":"GHSA-qv7r-wgc7-6mc6","title":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to...","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T18:31:38Z","modified":"2026-08-13T18:31:43Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:10:26.766632Z"}],"nvd":[{"id":"CVE-2026-73515","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T16:19:05.333Z","modified":"2026-09-24T20:02:50.26Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:12:37.557758Z"}],"osv":[{"id":"CVE-2026-73515","title":"PostGIS \u003c 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T15:37:09.289Z","modified":"2026-10-28T02:31:01.599030118Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:16.365946Z"},{"id":"DEBIAN-CVE-2026-73515","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T16:19:05.333Z","modified":"2026-11-03T23:00:07.126409031Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T23:33:35.474213Z"},{"id":"RHSA-2026:65899","title":"Red Hat Security Advisory: postgresql16-postgis security update","status":"published","published":"2026-09-10T10:17:04Z","modified":"2026-09-17T10:17:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67166","title":"Red Hat Security Advisory: postgresql18-postgis security update","status":"published","published":"2026-09-14T10:10:24Z","modified":"2026-10-06T10:16:01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67491","title":"Red Hat Security Advisory: postgresql:16 security update","status":"published","published":"2026-09-15T10:17:18Z","modified":"2026-10-19T10:05:48Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67848","title":"Red Hat Security Advisory: postgresql:18 security update","status":"published","published":"2026-09-17T10:18:01Z","modified":"2026-10-19T10:05:53Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RLSA-2026:65899","title":"Important: postgresql16-postgis security update","description":"PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS \"spatially enables\" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS \"Simple Features Specification for SQL\" and has been certified as compliant with the \"Types and Functions\" profile.\n\nSecurity Fix(es):\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-10T00:09:11.134895Z","modified":"2026-09-10T00:30:02.750739527Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67166","title":"Important: postgresql18-postgis security update","description":"PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS \"spatially enables\" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS \"Simple Features Specification for SQL\" and has been certified as compliant with the \"Types and Functions\" profile.\n\nSecurity Fix(es):\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T12:08:56.876794Z","modified":"2026-09-15T12:30:03.336946864Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67491","title":"Important: postgresql:16 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n\n* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n\n* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n\n* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n\n* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n\n* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n\n* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n\n* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n\n* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n\n* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n\n* postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n\n* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n\n* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-15T12:04:55.475235Z","modified":"2026-09-15T12:30:03.126268815Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:67848","title":"Important: postgresql:18 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n\n* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n\n* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n\n* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n\n* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n\n* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n\n* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n\n* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n\n* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n\n* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n\n* postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n\n* postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n\n* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n\n* postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n\n* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n\n* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-09-16T18:04:51.734663Z","modified":"2026-09-16T18:24:46.969630077Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:26.449929Z"},{"id":"RLSA-2026:97875","title":"Important: postgresql:16 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).\n\nSecurity Fix(es):\n\n* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n* pgvector: pgvector: Arbitrary code execution via out-of-bounds write during IVFFlat index build (CVE-2026-103484)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-11T00:04:53.161685Z","modified":"2026-11-11T00:30:02.554017364Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-11T00:46:19.477003Z"},{"id":"UBUNTU-CVE-2026-73515","description":"PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-08-13T16:19:00Z","modified":"2026-10-17T13:01:03.690308686Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","level":"high"},{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T16:57:08.628462Z"},{"id":"ALSA-2026:65899","title":"Important: postgresql16-postgis security update","description":"PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS \"spatially enables\" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS \"Simple Features Specification for SQL\" and has been certified as compliant with the \"Types and Functions\" profile.  \n\nSecurity Fix(es):  \n\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-09T00:00:00Z","modified":"2026-10-29T11:30:39.929639461Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67166","title":"Important: postgresql18-postgis security update","description":"PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS \"spatially enables\" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS \"Simple Features Specification for SQL\" and has been certified as compliant with the \"Types and Functions\" profile.  \n\nSecurity Fix(es):  \n\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-14T00:00:00Z","modified":"2026-10-29T11:30:27.835391879Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67491","title":"Important: postgresql:16 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-15T00:00:00Z","modified":"2026-10-29T11:32:32.020596049Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"ALSA-2026:67848","title":"Important: postgresql:18 security update","description":"PostgreSQL is an advanced object-relational database management system (DBMS).  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in pg_restore_attribute_stats() (CVE-2026-16238)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n  * postgresql: PostgreSQL pg_stat_statements: Arbitrary code execution via heap buffer overflow (CVE-2026-14676)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n  * postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-09-16T00:00:00Z","modified":"2026-10-29T11:32:32.067480091Z","updated_at":"2026-11-02T15:27:55.200553Z"},{"id":"BIT-postgis-2026-73515","title":"PostGIS \u003c 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer","description":"PostGIS before 3.7.0 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.","status":"published","published":"2026-09-25T15:20:21.187Z","modified":"2026-09-25T15:45:29.804346504Z","updated_at":"2026-11-02T15:28:34.724063Z"},{"id":"MGASA-2026-0524","title":"Updated postgis package fixes a security vulnerability","description":"PostGIS \u003c 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer.\n(CVE-2026-73515)\n","status":"published","published":"2026-10-20T02:38:36Z","modified":"2026-10-20T02:43:23.644406567Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}