Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-15742: Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14680: Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14671: Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14670: Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14669: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14662: Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Fixed packages 13
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | postgresql | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-contrib | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-debuginfo | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-devel | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-docs | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-libs | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-plperl | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-plpython | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-pltcl | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-server | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-static | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-test | 0:9.2.24-8.amzn2.0.11 |
| Amazon Linux · 2 | postgresql-upgrade | 0:9.2.24-8.amzn2.0.11 |
Vulnerabilities 6
-
High 8.8CVE-2026-14662 Public exploit
PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating s…
-
High 8.8CVE-2026-14669 Public exploit
PostgreSQL to_char heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, …
-
High 8.8
PostgreSQL plperl tied object heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24…
-
High 8.8
PostgreSQL refint plan cache type confusion executes arbitrary code
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "re…
-
High 8.8
PostgreSQL type confusion via "internal" arguments
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompati…
-
High 8.8
PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-14662.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-14669.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-14670.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-14671.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-14680.html
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-15742.html