PostgreSQL has released critical security updates addressing multiple high-impact vulnerabilities that could allow remote code execution (RCE), SQL injection, and denial-of-service (DoS) attacks across widely deployed database environments.
The PostgreSQL Global Development Group announced the release of versions 18.4, 17.10, 16.14, 15.18, and 14.23, fixing 11 security flaws and more than 60 bugs.
These vulnerabilities affect PostgreSQL versions 14 through 18 and pose significant risks to enterprise systems that rely on database-driven applications, especially when user input or replication features are exposed.
Several of the patched flaws enable attackers to execute arbitrary SQL commands or, under certain conditions, achieve code execution. Notably, memory corruption, privilege escalation, and injection vulnerabilities dominate this release, making immediate patching critical.
For example, a flaw in the refint module could allow an unprivileged user to trigger a stack buffer overflow, potentially leading to remote code execution on the host system. Similarly, SQL injection bugs in replication features could allow attackers to run unauthorized queries with elevated privileges.
PostgreSQL Flaws (CVE List)
- CVE-2026-6472 (CVSS 5.4): Missing authorization in CREATE TYPE allows attackers to hijack queries via search_path and execute arbitrary SQL functions.
- CVE-2026-6473 (CVSS 8.8): Integer wraparound leads to out-of-bounds writes and server crashes (potential memory corruption vector).
- CVE-2026-6474 (CVSS 4.3): Format string issue in timeofday() leaks portions of server memory.
- CVE-2026-6475 (CVSS 8.8): A symlink attack in pg_basebackup and pg_rewind allows overwriting arbitrary files.
- CVE-2026-6476 (CVSS 7.2): SQL injection in pg_createsubscriber allows execution of arbitrary SQL as superuser.
- CVE-2026-6477 (CVSS 8.8): libpq lo_* functions allow the server to overwrite client memory buffers.
- CVE-2026-6478 (CVSS 6.5): Timing attack exposes MD5-hashed passwords during authentication.
- CVE-2026-6479 (CVSS 7.5): SSL/GSS recursion flaw allows denial-of-service via socket connections.
- CVE-2026-6575 (CVSS 4.3): Buffer over-read in pg_restore_attribute_stats leaks memory data (PostgreSQL 18 only).
- CVE-2026-6637 (CVSS 8.8): The refint module enables stack overflow and SQL injection, leading to possible RCE.
- CVE-2026-6638 (CVSS 3.7): SQL injection in REFRESH PUBLICATION via table names in logical replication.
Affected Versions
- PostgreSQL 14 through 18 are impacted.
- Specific fixes are included in:
- 18.4
- 17.10
- 16.14
- 15.18
- 14.23
Older minor versions before these releases remain vulnerable.
Beyond security patches, the update resolves over 60 bugs affecting query correctness, replication reliability, backup handling, and performance optimization. Improvements include better partition pruning, fixes to foreign key behavior, and enhanced replication process handling.
The release also updates timezone data to tzdata 2026b, reflecting regional time changes such as British Columbia adopting permanent daylight saving time starting in November 2026.
Mitigation and Recommendations
Organizations using PostgreSQL should take immediate action:
- Upgrade to the latest patched versions (18.4, 17.10, 16.14, 15.18, 14.23).
- Avoid using MD5 password authentication; switch to SCRAM-SHA-256.
- Restrict privileges for replication and subscription-related roles.
- Audit the use of extensions such as refint and replication features.
- Monitor for abnormal queries or crashes indicating exploitation attempts.
PostgreSQL 14 will reach end-of-life on November 12, 2026. After this date, it will no longer receive security updates, increasing exposure to future vulnerabilities. Users are strongly advised to migrate to newer supported versions.
This release highlights the growing complexity of database attack surfaces, especially in features like logical replication and client libraries. Timely patching and secure configuration remain essential to defending against evolving threats targeting database infrastructure.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
.){kind=link}