Skip to content
OpenAdvisories
High ALAS2023-2026-2076 24 CVEs

Important: postgresql17 security update (Amazon Linux 2023)

Published Aug 31, 2026 · Updated Aug 31, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-6471: Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-6470: Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-6469: Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-6464: Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-19385: Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-18408: Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-18024: Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-16241: Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a byte value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-16239: Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-15742: Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-15741: SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. CVE-2026-14681: Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected. CVE-2026-14680: Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention

Fixed packages 30

ReleasePackageFixed in
Amazon Linux · 2023 postgresql17 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-contrib 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-contrib-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-debugsource 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-docs 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-docs-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-llvmjit 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-llvmjit-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-plperl 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-plperl-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-plpython3 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-plpython3-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-pltcl 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-pltcl-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-private-devel 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-private-libs 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-private-libs-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-server 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-server-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-server-devel 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-server-devel-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-static 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-test 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-test-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-test-rpm-macros 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-upgrade 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-upgrade-debuginfo 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-upgrade-devel 0:17.11-1.amzn2023.0.1
Amazon Linux · 2023 postgresql17-upgrade-devel-debuginfo 0:17.11-1.amzn2023.0.1

Vulnerabilities 24

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14662.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14663.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14664.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14666.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14668.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14669.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14670.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14671.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14672.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14678.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14679.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14680.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-14681.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15741.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-15742.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16239.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-16241.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-18024.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-18408.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-19385.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6464.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6469.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6470.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-6471.html