PostgreSQL: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 5

• High 8.8
  CVE-2026-2004

  PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

  Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and …

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 12, 2026
• High 8.8
  CVE-2026-2005 Public exploit

  PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

  Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 12, 2026
• High 8.8
  CVE-2026-2006

  PostgreSQL missing validation of multibyte character length executes arbitrary code

  Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions…

  rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 12, 2026
• High 8.2
  CVE-2026-2007

  PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

  Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to pri…

  postgresql-9.3 postgresql15 postgresql16 postgresql17 Debian Ubuntu Alpine
  Feb 12, 2026
• Medium 4.3
  CVE-2026-2003

  PostgreSQL oidvector discloses a few bytes of memory

  Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely.…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  Feb 12, 2026

Revision history

1. 2026-10-21 #33

   Neue Updates von Oracle Linux aufgenommen

2. 2026-10-13 #32

   Neue Updates von IBM aufgenommen

3. 2026-09-30 #31

   Neue Updates von Oracle Linux aufgenommen

4. 2026-09-23 #30

   Neue Updates von Oracle Linux aufgenommen

5. 2026-09-03 #29

   Neue Updates von Dell aufgenommen

6. 2026-08-31 #28

   Neue Updates von Amazon und Dell aufgenommen

7. 2026-08-16 #27

   Neue Updates von Gentoo aufgenommen

8. 2026-07-23 #26

   Neue Updates von IBM aufgenommen

9. 2026-06-28 #25

   Neue Updates von IBM aufgenommen

10. 2026-06-25 #24

    Neue Updates von Oracle Linux aufgenommen

11. 2026-06-10 #23

    Neue Updates von Splunk-SVD aufgenommen

12. 2026-05-31 #22

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

13. 2026-05-19 #21

    Neue Updates von Red Hat aufgenommen

14. 2026-05-04 #20

    PoC aufgenommen

15. 2026-04-09 #19

    Neue Updates von SUSE aufgenommen

16. 2026-04-08 #18

    Neue Updates von Debian aufgenommen

17. 2026-04-06 #17

    Neue Updates von openSUSE aufgenommen

18. 2026-04-01 #16

    Neue Updates von SUSE aufgenommen

19. 2026-03-25 #15

    Neue Updates von openSUSE aufgenommen

20. 2026-03-19 #14

    Neue Updates von Amazon aufgenommen

21. 2026-03-18 #13

    Neue Updates von Red Hat aufgenommen

22. 2026-03-12 #12

    Neue Updates von Red Hat und SUSE aufgenommen

23. 2026-03-11 #11

    Neue Updates von Red Hat aufgenommen

24. 2026-03-10 #10

    Neue Updates von Oracle Linux und Red Hat aufgenommen

25. 2026-03-09 #9

    Neue Updates von Red Hat, Oracle Linux und Rocky Enterprise Software Foundation aufgenommen

References

• PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 Release vom 2026-02-12
  https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/
• PostgreSQL Security Advisory CVE-2026-2003 vom 2026-02-12
  https://www.postgresql.org/support/security/CVE-2026-2003/
• GitHub Security Advisory GHSA-f3vj-j2m6-8hfj vom 2026-02-12
  https://github.com/advisories/GHSA-f3vj-j2m6-8hfj
• Red Hat Bugtracker #2439322 vom 2026-02-12
  https://bugzilla.redhat.com/show_bug.cgi?id=2439322
• PostgreSQL Security Advisory CVE-2026-2004 vom 2026-02-12
  https://www.postgresql.org/support/security/CVE-2026-2004/
• GitHub Security Advisory GHSA-qw3h-8vxv-jf6c vom 2026-02-12
  https://github.com/advisories/GHSA-qw3h-8vxv-jf6c
• Red Hat Bugtracker #2439325 vom 2026-02-12
  https://bugzilla.redhat.com/show_bug.cgi?id=2439325
• PostgreSQL Security Advisory CVE-2026-2005 vom 2026-02-12
  https://www.postgresql.org/support/security/CVE-2026-2005/
• Red Hat Bugtracker #2439326 vom 2026-02-12
  https://bugzilla.redhat.com/show_bug.cgi?id=2439326
• PostgreSQL Security Advisory CVE-2026-2006 vom 2026-02-12
  https://www.postgresql.org/support/security/CVE-2026-2006/
• Red Hat Bugtracker #2439324 vom 2026-02-12
  https://bugzilla.redhat.com/show_bug.cgi?id=2439324
• PostgreSQL Security Advisory CVE-2026-2007 vom 2026-02-12
  https://www.postgresql.org/support/security/CVE-2026-2007/
• Red Hat Bugtracker #2439320 vom 2026-02-12
  https://bugzilla.redhat.com/show_bug.cgi?id=2439320
• Debian Security Advisory DSA-6132 vom 2026-02-12
  https://lists.debian.org/debian-security-announce/2026/msg00041.html
• Debian Security Advisory DSA-6133 vom 2026-02-12
  https://lists.debian.org/debian-security-announce/2026/msg00042.html
• openSUSE Security Update OPENSUSE-SU-2026:10191-1 vom 2026-02-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/R53OUKSEGWIIMFAAZXYBZUVE5KDE2B57/
• openSUSE Security Update OPENSUSE-SU-2026:10190-1 vom 2026-02-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IRHTTMYUCNL4VTAVCEDKZMZF74V55WVH/
• openSUSE Security Update OPENSUSE-SU-2026:10192-1 vom 2026-02-13
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YPKEKVHFWO7KZTLMHDJG6RGN4KEOD4EU/
• SUSE Security Update SUSE-SU-2026:0588-1 vom 2026-02-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024359.html
• SUSE Security Update SUSE-SU-2026:0584-1 vom 2026-02-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024362.html
• SUSE Security Update SUSE-SU-2026:0585-1 vom 2026-02-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024361.html
• SUSE Security Update SUSE-SU-2026:0586-1 vom 2026-02-20
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024360.html
• SUSE Security Update SUSE-SU-2026:0614-1 vom 2026-02-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024381.html
• SUSE Security Update SUSE-SU-2026:0616-1 vom 2026-02-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024379.html
• SUSE Security Update SUSE-SU-2026:0615-1 vom 2026-02-24
  https://lists.suse.com/pipermail/sle-security-updates/2026-February/024380.html
• SUSE Security Update SUSE-SU-2026:0769-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024548.html
• SUSE Security Update SUSE-SU-2026:0784-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024534.html
• SUSE Security Update SUSE-SU-2026:0785-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024533.html
• SUSE Security Update SUSE-SU-2026:0786-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024532.html
• SUSE Security Update SUSE-SU-2026:0787-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024531.html
• SUSE Security Update SUSE-SU-2026:0771-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024546.html
• SUSE Security Update SUSE-SU-2026:0770-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024547.html
• SUSE Security Update SUSE-SU-2026:0768-1 vom 2026-03-03
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024549.html
• Ubuntu Security Notice USN-8072-1 vom 2026-03-04
  https://ubuntu.com/security/notices/USN-8072-1
• Red Hat Security Advisory RHSA-2026:3730 vom 2026-03-04
  https://access.redhat.com/errata/RHSA-2026:3730
• Rocky Linux Security Advisory RLSA-2026:3896 vom 2026-03-06
  https://errata.build.resf.org/RLSA-2026:3896
• SUSE Security Update SUSE-SU-2026:20588-1 vom 2026-03-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024618.html
• Red Hat Security Advisory RHSA-2026:3896 vom 2026-03-05
  https://access.redhat.com/errata/RHSA-2026:3896
• Amazon Linux Security Advisory ALAS2POSTGRESQL14-2026-022 vom 2026-03-06
  https://alas.aws.amazon.com/AL2/ALAS2POSTGRESQL14-2026-022.html
• Rocky Linux Security Advisory RLSA-2026:3730 vom 2026-03-06
  https://errata.build.resf.org/RLSA-2026:3730
• Rocky Linux Security Advisory RLSA-2026:3887 vom 2026-03-06
  https://errata.build.resf.org/RLSA-2026:3887
• Red Hat Security Advisory RHSA-2026:3887 vom 2026-03-05
  https://access.redhat.com/errata/RHSA-2026:3887
• SUSE Security Update SUSE-SU-2026:20587-1 vom 2026-03-05
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024619.html
• Oracle Linux Security Advisory ELSA-2026-3887 vom 2026-03-06
  https://linux.oracle.com/errata/ELSA-2026-3887.html
• Oracle Linux Security Advisory ELSA-2026-3730 vom 2026-03-06
  https://linux.oracle.com/errata/ELSA-2026-3730.html
• Red Hat Security Advisory RHSA-2026:4059 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4059
• Red Hat Security Advisory RHSA-2026:4024 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4024
• Red Hat Security Advisory RHSA-2026:4074 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4074
• Oracle Linux Security Advisory ELSA-2026-4024 vom 2026-03-10
  https://linux.oracle.com/errata/ELSA-2026-4024.html
• Red Hat Security Advisory RHSA-2026:4063 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4063
• Red Hat Security Advisory RHSA-2026:4064 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4064
• Oracle Linux Security Advisory ELSA-2026-4063 vom 2026-03-10
  https://linux.oracle.com/errata/ELSA-2026-4063.html
• Red Hat Security Advisory RHSA-2026:4075 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4075
• Red Hat Security Advisory RHSA-2026:4110 vom 2026-03-09
  https://access.redhat.com/errata/RHSA-2026:4110
• Oracle Linux Security Advisory ELSA-2026-4110 vom 2026-03-10
  https://linux.oracle.com/errata/ELSA-2026-4110.html
• Rocky Linux Security Advisory RLSA-2026:4024 vom 2026-03-09
  https://errata.build.resf.org/RLSA-2026:4024
• Rocky Linux Security Advisory RLSA-2026:4059 vom 2026-03-09
  https://errata.build.resf.org/RLSA-2026:4059
• Rocky Linux Security Advisory RLSA-2026:4063 vom 2026-03-10
  https://errata.build.resf.org/RLSA-2026:4063
• Rocky Linux Security Advisory RLSA-2026:4064 vom 2026-03-09
  https://errata.build.resf.org/RLSA-2026:4064
• Rocky Linux Security Advisory RLSA-2026:4110 vom 2026-03-10
  https://errata.build.resf.org/RLSA-2026:4110
• Oracle Linux Security Advisory ELSA-2026-3896 vom 2026-03-09
  https://linux.oracle.com/errata/ELSA-2026-3896.html
• Oracle Linux Security Advisory ELSA-2026-4059 vom 2026-03-10
  https://linux.oracle.com/errata/ELSA-2026-4059.html
• Oracle Linux Security Advisory ELSA-2026-4064 vom 2026-03-11
  http://linux.oracle.com/errata/ELSA-2026-4064.html
• Red Hat Security Advisory RHSA-2026:4254 vom 2026-03-11
  https://access.redhat.com/errata/RHSA-2026:4254
• Red Hat Security Advisory RHSA-2026:4441 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4441
• Red Hat Security Advisory RHSA-2026:4504 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4504
• SUSE Security Update SUSE-SU-2026:0883-1 vom 2026-03-12
  https://lists.suse.com/pipermail/sle-security-updates/2026-March/024682.html
• Red Hat Security Advisory RHSA-2026:4548 vom 2026-03-13
  https://access.redhat.com/errata/RHSA-2026:4548
• Red Hat Security Advisory RHSA-2026:4544 vom 2026-03-13
  https://access.redhat.com/errata/RHSA-2026:4544
• Red Hat Security Advisory RHSA-2026:4546 vom 2026-03-13
  https://access.redhat.com/errata/RHSA-2026:4546
• Red Hat Security Advisory RHSA-2026:4515 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4515
• Red Hat Security Advisory RHSA-2026:4516 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4516
• Red Hat Security Advisory RHSA-2026:4547 vom 2026-03-13
  https://access.redhat.com/errata/RHSA-2026:4547
• Red Hat Security Advisory RHSA-2026:4518 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4518
• Red Hat Security Advisory RHSA-2026:4524 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4524
• Red Hat Security Advisory RHSA-2026:4509 vom 2026-03-13
  https://access.redhat.com/errata/RHSA-2026:4509
• Red Hat Security Advisory RHSA-2026:4528 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4528
• Red Hat Security Advisory RHSA-2026:4475 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4475
• Red Hat Security Advisory RHSA-2026:4505 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4505
• Red Hat Security Advisory RHSA-2026:4506 vom 2026-03-12
  https://access.redhat.com/errata/RHSA-2026:4506