Skip to content
OpenAdvisories

Description

Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Affected products

VendorProductAffectedFixed
— PostgreSQL 18 – < 18.2, 17 – < 17.8, 16 – < 16.12, 15 – < 15.16, < 14.21 18.2

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 postgresql-18 18.2-1 —
Debian 13 postgresql-17 17.8-0+deb13u1 DSA-6133-1
Debian 12 postgresql-15 15.16-0+deb12u1 DSA-6132-1
ReleasePackageFixed inAdvisory
Ubuntu 25.10 postgresql-17 17.9-0ubuntu0.25.10.1 —
Ubuntu 24.04 LTS postgresql-16 16.13-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS postgresql-14 14.22-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS postgresql-12 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS postgresql-10 No fix yet —
Ubuntu Pro 16.04 LTS postgresql-9.5 No fix yet —
Ubuntu Pro 14.04 LTS postgresql-9.3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 postgresql +15 16.13-1.el10_1 RHSA-2026:19010, RHSA-2026:3887
RHEL 10 postgresql18 +13 18.3-1.el10_2 RHSA-2026:19009
RHEL 9 pg_repack 1.4.8-2.module+el9.5.0+22224+f5585c78 RHSA-2026:4110, RHSA-2026:3896
RHEL 9 pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4110, RHSA-2026:3896
RHEL 9 pgvector 0.6.2-2.module+el9.6.0+22979+c3d78d52 RHSA-2026:4110
RHEL 9 postgis +4 3.5.3-3.module+el9.7.0+23421+025f8139 RHSA-2026:4110
RHEL 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4110, RHSA-2026:3896
RHEL 9 postgresql +14 13.23-2.el9_7 RHSA-2026:4110, RHSA-2026:3896, RHSA-2026:3730
RHEL 8 pg_repack 1.4.8-1.module+el8.9.0+19797+c4ce5969 RHSA-2026:4063, RHSA-2026:4059
RHEL 8 pgaudit 1.7.0-1.module+el8.9.0+19797+c4ce5969 RHSA-2026:4063, RHSA-2026:4059
RHEL 8 postgres-decoderbufs 1.9.7-1.Final.module+el8.9.0+19797+c4ce5969 RHSA-2026:4063, RHSA-2026:4059
RHEL 8 postgresql +14 15.17-1.module+el8.10.0+24043+d28c3b3f RHSA-2026:4063, RHSA-2026:4059
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS postgresql +15 16.13-1.el10_0 RHSA-2026:4441
RHEL 9.6 EUS pg_repack 1.4.8-2.module+el9.5.0+22224+f5585c78 RHSA-2026:4547, RHSA-2026:4546
RHEL 9.6 EUS pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4547, RHSA-2026:4546
RHEL 9.6 EUS pgvector 0.6.2-2.module+el9.6.0+22979+c3d78d52 RHSA-2026:4547
RHEL 9.6 EUS postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4547, RHSA-2026:4546
RHEL 9.6 EUS postgresql +14 15.17-1.module+el9.6.0+24075+d1e73d59 RHSA-2026:4547, RHSA-2026:4546
RHEL 9.4 EUS pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4548, RHSA-2026:4544
RHEL 9.4 EUS pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4548, RHSA-2026:4544
RHEL 9.4 EUS postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4548, RHSA-2026:4544
RHEL 9.4 EUS postgresql +14 15.17-1.module+el9.4.0+24062+0e16bfab RHSA-2026:4548, RHSA-2026:4544
RHEL 9.2 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4254
RHEL 9.2 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4254
RHEL 9.2 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:4254
RHEL 9.2 E4S postgresql +14 15.17-1.module+el9.2.0+24076+9f04ec7d RHSA-2026:4254
RHEL 8.8 E4S pg_repack 1.4.8-1.module+el8.8.0+17071+aaaceaa4 RHSA-2026:4515
RHEL 8.8 E4S pgaudit 1.7.0-1.module+el8.8.0+17071+aaaceaa4 RHSA-2026:4515
RHEL 8.8 E4S postgres-decoderbufs 1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4 RHSA-2026:4515
RHEL 8.8 E4S postgresql +14 15.17-1.module+el8.8.0+24064+070714b8 RHSA-2026:4515
Red Hat Hardened Images 1 postgresql18 18.3-1.2.hum1 RHSA-2026:8756

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 postgresql +13 16.13-1.el10_2 ALSA-2026:19010
AlmaLinux 10 postgresql-test-rpm-macros 16.13-1.el10_1 ALSA-2026:19010, ALSA-2026:3887
AlmaLinux 10 postgresql18 +13 18.3-1.el10_2 ALSA-2026:19009
AlmaLinux 9 pg_repack 1.4.8-2.module_el9.5.0+119+18833d03 ALSA-2026:4110, ALSA-2026:3896
AlmaLinux 9 pgaudit 1.7.0-1.module_el9.3.0+52+21733919 ALSA-2026:4110, ALSA-2026:3896
AlmaLinux 9 pgvector 0.6.2-2.module_el9.6.0+167+4e561146 ALSA-2026:4110
AlmaLinux 9 postgis +4 3.5.3-3.module_el9.7.0+187+2286ff0a ALSA-2026:4110
AlmaLinux 9 postgres-decoderbufs 1.9.7-1.Final.module_el9.3.0+52+21733919 ALSA-2026:4110, ALSA-2026:3896
AlmaLinux 9 postgresql +14 13.23-2.el9_7 ALSA-2026:4110, ALSA-2026:3896, ALSA-2026:3730
AlmaLinux 8 pg_repack 1.4.8-1.module_el8.9.0+3706+885c732e ALSA-2026:4063, ALSA-2026:4059
AlmaLinux 8 pgaudit 1.7.0-1.module_el8.9.0+3706+885c732e ALSA-2026:4063, ALSA-2026:4059
AlmaLinux 8 postgres-decoderbufs 1.9.7-1.Final.module_el8.9.0+3706+885c732e ALSA-2026:4063, ALSA-2026:4059
AlmaLinux 8 postgresql +14 15.17-1.module_el8.10.0+4127+dc6e3c5c ALSA-2026:4063, ALSA-2026:4059

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 postgresql16 16.13-1.el10_1 RLSA-2026:19010
Rocky Linux 10 postgresql18 18.3-1.el10 RLSA-2026:19009
Rocky Linux 9 pg_repack 1.5.1-1.module+el9.7.0+40012+a654bbaa RLSA-2026:4110
Rocky Linux 9 pgaudit 16.0-1.module+el9.7.0+40012+a654bbaa RLSA-2026:4110
Rocky Linux 9 pgvector 0.6.2-2.module+el9.7.0+40012+a654bbaa RLSA-2026:4110
Rocky Linux 9 postgis 3.5.3-3.module+el9.7.0+40012+a654bbaa RLSA-2026:4110
Rocky Linux 9 postgres-decoderbufs 2.4.0-1.Final.module+el9.7.0+40012+a654bbaa RLSA-2026:4110
ReleasePackageFixed inAdvisory
SLES 15 SP7 postgresql14 14.22-150600.16.28.1 SUSE-SU-2026:0786-1
SLES 15 SP7 postgresql15 15.17-150600.16.28.1 SUSE-SU-2026:0771-1
SLES 15 SP7 postgresql16 16.13-150600.16.30.1 SUSE-SU-2026:0882-1
SLES 15 SP7 postgresql17 17.9-150600.13.24.1 SUSE-SU-2026:0883-1
SLES 15 SP7 postgresql18 18.3-150600.13.8.1 SUSE-SU-2026:0881-1
SLES 15 SP6 postgresql14 14.22-150600.16.28.1 SUSE-SU-2026:0786-1
SLES 15 SP6 postgresql15 15.17-150600.16.28.1 SUSE-SU-2026:0771-1
SLES 15 SP6 postgresql16 16.13-150600.16.30.1 SUSE-SU-2026:0882-1
SLES 15 SP6 postgresql17 17.9-150600.13.24.1 SUSE-SU-2026:0883-1
SLES 15 SP6 postgresql18 18.3-150600.13.8.1 SUSE-SU-2026:0881-1
SLES 15 SP5 postgresql14 14.22-150200.5.69.1 SUSE-SU-2026:0768-1
SLES 15 SP5 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLES 15 SP5 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLES 15 SP5 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLES 15 SP5 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
SLES 15 SP4 postgresql14 14.22-150200.5.69.1 SUSE-SU-2026:0768-1
SLES 15 SP4 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLES 15 SP4 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLES 15 SP4 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLES 15 SP4 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
SLES 12 SP5 postgresql14 14.21-3.66.1 SUSE-SU-2026:0616-1
SLES 12 SP5 postgresql15 15.16-3.50.1 SUSE-SU-2026:0615-1
SLES 12 SP5 postgresql16 16.12-3.38.1 SUSE-SU-2026:0614-1
SLES 12 SP5 postgresql18 18.2-8.6.1 SUSE-SU-2026:0585-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 postgresql14 14.21-160000.1.1 SUSE-SU-2026:20587-1
SLES for SAP 16.0 postgresql15 15.16-160000.1.1 SUSE-SU-2026:20588-1
SLES for SAP 16.0 postgresql16 16.13-160000.1.1 SUSE-SU-2026:20983-1
SLES for SAP 16.0 postgresql17 17.9-160000.1.1 SUSE-SU-2026:20906-1
SLES for SAP 16.0 postgresql18 18.3-160000.1.1 SUSE-SU-2026:20921-1
SLES for SAP 15 SP6 postgresql14 14.22-150600.16.28.1 SUSE-SU-2026:0786-1
SLES for SAP 15 SP6 postgresql15 15.17-150600.16.28.1 SUSE-SU-2026:0771-1
SLES for SAP 15 SP6 postgresql16 16.13-150600.16.30.1 SUSE-SU-2026:0882-1
SLES for SAP 15 SP6 postgresql17 17.9-150600.13.24.1 SUSE-SU-2026:0883-1
SLES for SAP 15 SP6 postgresql18 18.3-150600.13.8.1 SUSE-SU-2026:0881-1
SLES for SAP 15 SP5 postgresql14 14.22-150200.5.69.1 SUSE-SU-2026:0768-1
SLES for SAP 15 SP5 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLES for SAP 15 SP5 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLES for SAP 15 SP5 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLES for SAP 15 SP5 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
SLES for SAP 15 SP4 postgresql14 14.22-150200.5.69.1 SUSE-SU-2026:0768-1
SLES for SAP 15 SP4 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLES for SAP 15 SP4 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLES for SAP 15 SP4 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLES for SAP 15 SP4 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
SLES 16.0 postgresql14 14.21-160000.1.1 SUSE-SU-2026:20587-1
SLES 16.0 postgresql15 15.16-160000.1.1 SUSE-SU-2026:20588-1
SLES 16.0 postgresql16 16.13-160000.1.1 SUSE-SU-2026:20983-1
SLES 16.0 postgresql17 17.9-160000.1.1 SUSE-SU-2026:20906-1
SLES 16.0 postgresql18 18.3-160000.1.1 SUSE-SU-2026:20921-1
SLE HPC 15 SP5 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLE HPC 15 SP5 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLE HPC 15 SP5 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLE HPC 15 SP5 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
SLE HPC 15 SP4 postgresql14 14.22-150200.5.69.1 SUSE-SU-2026:0768-1
SLE HPC 15 SP4 postgresql15 15.17-150200.5.54.1 SUSE-SU-2026:0770-1
SLE HPC 15 SP4 postgresql16 16.12-150200.5.38.1 SUSE-SU-2026:0588-1
SLE HPC 15 SP4 postgresql17 17.8-150200.5.22.1 SUSE-SU-2026:0586-1
SLE HPC 15 SP4 postgresql18 18.2-150200.5.6.1 SUSE-SU-2026:0584-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql14 14.21-1.1 openSUSE-SU-2026:10190-1
openSUSE Tumbleweed postgresql15 15.16-1.1 openSUSE-SU-2026:10191-1
openSUSE Tumbleweed postgresql16 16.12-1.1 openSUSE-SU-2026:10192-1
openSUSE Tumbleweed postgresql17 17.8-1.1 openSUSE-SU-2026:10193-1
openSUSE Tumbleweed postgresql18 18.2-1.1 openSUSE-SU-2026:10197-1
openSUSE Leap 16.0 postgresql14 14.21-160000.1.1 openSUSE-SU-2026:20265-1
openSUSE Leap 16.0 postgresql15 15.16-160000.1.1 openSUSE-SU-2026:20266-1
openSUSE Leap 16.0 postgresql16 16.13-160000.1.1 openSUSE-SU-2026:20447-1
openSUSE Leap 16.0 postgresql17 17.9-160000.1.1 openSUSE-SU-2026:20388-1
openSUSE Leap 16.0 postgresql18 +1 18.3-160000.1.1 openSUSE-SU-2026:20408-1
openSUSE Leap 15.6 postgresql14 14.22-150600.16.28.1 SUSE-SU-2026:0786-1
openSUSE Leap 15.6 postgresql15 15.17-150600.16.28.1 SUSE-SU-2026:0771-1
openSUSE Leap 15.6 postgresql16 16.13-150600.16.30.1 SUSE-SU-2026:0882-1
openSUSE Leap 15.6 postgresql17 17.9-150600.13.24.1 SUSE-SU-2026:0883-1
openSUSE Leap 15.6 postgresql18 18.3-150600.13.8.1 SUSE-SU-2026:0881-1
ReleasePackageFixed inAdvisory
Alpine v3.24 postgresql16 16.12-r0 —
Alpine v3.24 postgresql17 17.8-r0 —
Alpine v3.24 postgresql18 18.2-r0 —
Alpine v3.23 postgresql16 16.12-r0 —
Alpine v3.23 postgresql17 17.8-r0 —
Alpine v3.23 postgresql18 18.2-r0 —
Alpine v3.22 postgresql15 15.16-r0 —
Alpine v3.22 postgresql16 16.12-r0 —
Alpine v3.22 postgresql17 17.8-r0 —
Alpine v3.21 postgresql16 16.12-r0 —
Alpine v3.21 postgresql17 17.8-r0 —
Alpine v3.20 postgresql15 15.16-r0 —
Alpine v3.20 postgresql16 16.12-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 postgresql15 +15 15.16-1.amzn2023.0.1 ALAS2023-2026-1456
Amazon Linux 2023 postgresql16 +15 16.12-1.amzn2023.0.1 ALAS2023-2026-1458
Amazon Linux 2023 postgresql17 +15 17.8-1.amzn2023.0.1 ALAS2023-2026-1457

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 postgresql 16.12-1 —
Azure Linux 2 (CBL-Mariner) postgresql 14.21-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 postgresql +14 16.13-1.0.1.el10_2 ELSA-2026-19010
Oracle Linux 10 postgresql18 +13 18.3-1.0.1.el10_2 ELSA-2026-19009
Oracle Linux 9 pg_repack 1.5.1-1.module+el9.6.0+90592+523cb846 ELSA-2026-4110
Oracle Linux 9 pgaudit 16.0-1.module+el9.4.0+90394+9e4f3cba ELSA-2026-4110
Oracle Linux 9 pgvector 0.6.2-2.module+el9.6.0+90592+523cb846 ELSA-2026-4110
Oracle Linux 9 postgis +4 3.5.3-3.module+el9.7.0+90669+cd4abef7 ELSA-2026-4110
Oracle Linux 9 postgres-decoderbufs 2.4.0-1.Final.module+el9.4.0+90394+9e4f3cba ELSA-2026-4110
Oracle Linux 9 postgresql +14 16.13-1.module+el9.7.0+90831+7907f012 ELSA-2026-4110

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling postgresql-13 13.23-r5 —

Advisories 50

References