Skip to content
OpenAdvisories
Unscored USN-8072-1 0 CVEs

postgresql-14, postgresql-16, postgresql-17 vulnerabilities

Published Mar 4, 2026 · Updated Jun 30, 2026

Summary

Altan Birler discovered that PostgreSQL incorrectly validated oidvector
types. An attacker could possibly use this issue to obtain a few bytes of
sensitive information. (CVE-2026-2003)

Daniel Firer discovered that PostgreSQL incorrectly validated input in the
intarray extension. An attacker could possibly use this issue to execute
arbitrary code. (CVE-2026-2004)

It was dicovered that PosgreSQL incorrectly handled certain pgcrypto memory
operations. An attacker could possibly use this issue to execute arbitrary
code. (CVE-2026-2005)

Paul Gerste and Moritz Sanft discovered that PostgreSQL incorrectly
validated multibyte character lengths. An attacker could possibly use this
issue to execute arbitrary code. (CVE-2026-2006)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 22.04 LTS 22.04:LTS postgresql-14 14.22-0ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS postgresql-16 16.13-0ubuntu0.24.04.1
Ubuntu · 25.10 postgresql-17 17.9-0ubuntu0.25.10.1

References

  • report
    https://ubuntu.com/security/CVE-2026-2003
  • report
    https://ubuntu.com/security/CVE-2026-2004
  • report
    https://ubuntu.com/security/CVE-2026-2005
  • report
    https://ubuntu.com/security/CVE-2026-2006