Summary
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.
Security Fix(es):
* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | libpq | 16.14-1.el10_2 |
| AlmaLinux · 10 | libpq-devel | 16.14-1.el10_2 |
Vulnerabilities 1
-
High 8.8
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…