Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-2005: Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | postgresql | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-contrib | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-debuginfo | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-devel | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-docs | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-libs | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-plperl | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-plpython | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-pltcl | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-server | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-static | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-test | 0:9.2.24-8.amzn2.0.9 |
| Amazon Linux · 2 | postgresql-upgrade | 0:9.2.24-8.amzn2.0.9 |
Vulnerabilities 1
-
High 8.8CVE-2026-2005 Public exploit
PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-2005.html