Summary
PostGIS adds support for geographic objects to the PostgreSQL object-relational database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic information systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS follows the OpenGIS "Simple Features Specification for SQL" and has been certified as compliant with the "Types and Functions" profile.
Security Fix(es):
* postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer (CVE-2026-73515)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | postgis | 3.5.3-4.el10_2.1 |
| AlmaLinux · 10 | postgis-client | 3.5.3-4.el10_2.1 |
| AlmaLinux · 10 | postgis-docs | 3.5.3-4.el10_2.1 |
| AlmaLinux · 10 | postgis-upgrade | 3.5.3-4.el10_2.1 |
| AlmaLinux · 10 | postgis-utils | 3.5.3-4.el10_2.1 |
Vulnerabilities 1
-
High 8.1
PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field …