Summary
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.
Security Fix(es):
* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | libpq | 0:13.23-3.el9_8 |
Vulnerabilities 1
-
High 8.8
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477442