Description
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PostgreSQL | 18 – < 18.2, 17 – < 17.8, 16 – < 16.12, 15 – < 15.16, < 14.21 | 18.2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgresql-18 | 18.2-1 | — |
| Debian 13 | postgresql-17 | 17.8-0+deb13u1 | DSA-6133-1 |
| Debian 12 | postgresql-15 | 15.16-0+deb12u1 | DSA-6132-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.10 | postgresql-17 | 17.9-0ubuntu0.25.10.1 | — |
| Ubuntu 24.04 LTS | postgresql-16 | 16.13-0ubuntu0.24.04.1 | — |
| Ubuntu 22.04 LTS | postgresql-14 | 14.22-0ubuntu0.22.04.1 | — |
| Ubuntu 20.04 LTS | postgresql-12 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | postgresql-10 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | postgresql-9.5 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | postgresql-9.3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | postgresql +15 | 16.13-1.el10_1 | RHSA-2026:19010, RHSA-2026:3887 |
| RHEL 10 | postgresql18 +13 | 18.3-1.el10_2 | RHSA-2026:19009 |
| RHEL 9 | pg_repack | 1.4.8-2.module+el9.5.0+22224+f5585c78 | RHSA-2026:4110, RHSA-2026:3896 |
| RHEL 9 | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4110, RHSA-2026:3896 |
| RHEL 9 | pgvector | 0.6.2-2.module+el9.6.0+22979+c3d78d52 | RHSA-2026:4110 |
| RHEL 9 | postgis +4 | 3.5.3-3.module+el9.7.0+23421+025f8139 | RHSA-2026:4110 |
| RHEL 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4110, RHSA-2026:3896 |
| RHEL 9 | postgresql +14 | 13.23-2.el9_7 | RHSA-2026:4110, RHSA-2026:3896, RHSA-2026:3730 |
| RHEL 8 | pg_repack | 1.4.6-3.module+el8.9.0+19330+c97ddbdf | RHSA-2026:4064, RHSA-2026:4063, RHSA-2026:4059 |
| RHEL 8 | pgaudit | 1.4.0-7.module+el8.10.0+22214+9beb89d6 | RHSA-2026:4064, RHSA-2026:4063, RHSA-2026:4059 |
| RHEL 8 | postgres-decoderbufs | 0.10.0-2.module+el8.9.0+19330+c97ddbdf | RHSA-2026:4064, RHSA-2026:4063, RHSA-2026:4059 |
| RHEL 8 | postgresql +12 | 12.22-6.module+el8.10.0+24045+2b30545f | RHSA-2026:4064, RHSA-2026:4063, RHSA-2026:4059 |
| RHEL 8 | postgresql-private-libs +1 | 15.17-1.module+el8.10.0+24043+d28c3b3f | RHSA-2026:4063, RHSA-2026:4059 |
Show 14 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | postgresql +15 | 16.13-1.el10_0 | RHSA-2026:4441 |
| RHEL 9.6 EUS | pg_repack | 1.4.8-2.module+el9.5.0+22224+f5585c78 | RHSA-2026:4547, RHSA-2026:4546 |
| RHEL 9.6 EUS | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4547, RHSA-2026:4546 |
| RHEL 9.6 EUS | pgvector | 0.6.2-2.module+el9.6.0+22979+c3d78d52 | RHSA-2026:4547 |
| RHEL 9.6 EUS | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4547, RHSA-2026:4546 |
| RHEL 9.6 EUS | postgresql +14 | 13.23-1.el9_6.1 | RHSA-2026:4547, RHSA-2026:4546, RHSA-2026:4528 |
| RHEL 9.4 EUS | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4548, RHSA-2026:4544 |
| RHEL 9.4 EUS | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4548, RHSA-2026:4544 |
| RHEL 9.4 EUS | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4548, RHSA-2026:4544 |
| RHEL 9.4 EUS | postgresql +13 | 13.23-1.el9_4.1 | RHSA-2026:4548, RHSA-2026:4544, RHSA-2026:4524 |
| RHEL 9.4 EUS | postgresql-test-rpm-macros | 15.17-1.module+el9.4.0+24062+0e16bfab | RHSA-2026:4548, RHSA-2026:4544 |
| RHEL 9.2 E4S | pg_repack | 1.4.8-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4254 |
| RHEL 9.2 E4S | pgaudit | 1.7.0-1.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4254 |
| RHEL 9.2 E4S | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 | RHSA-2026:4254 |
| RHEL 9.2 E4S | postgresql +7 | 13.23-1.el9_2.1 | RHSA-2026:4475, RHSA-2026:4254 |
| RHEL 9.2 E4S | postgresql-docs +6 | 15.17-1.module+el9.2.0+24076+9f04ec7d | RHSA-2026:4254 |
| RHEL 9.0 E4S | postgresql +7 | 13.23-1.el9_0.1 | RHSA-2026:4518 |
| RHEL 8.8 TUS | pg_repack | 1.4.6-3.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 TUS | pgaudit | 1.4.0-5.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 TUS | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 TUS | postgresql +12 | 12.22-1.module+el8.8.0+24047+e7ffc146.3 | RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 E4S | pg_repack | 1.4.6-3.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4515, RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 E4S | pgaudit | 1.4.0-5.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4515, RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 E4S | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4515, RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 E4S | postgresql +12 | 12.22-1.module+el8.8.0+24047+e7ffc146.3 | RHSA-2026:4515, RHSA-2026:4075, RHSA-2026:4074 |
| RHEL 8.8 E4S | postgresql-private-libs +1 | 15.17-1.module+el8.8.0+24064+070714b8 | RHSA-2026:4515 |
| RHEL 8.6 TUS | pg_repack | 1.4.6-3.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 TUS | pgaudit | 1.4.0-5.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 TUS | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 TUS | postgresql +12 | 12.22-1.module+el8.6.0+24068+6365202e.3 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 E4S | pg_repack | 1.4.6-3.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 E4S | pgaudit | 1.4.0-5.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 E4S | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 E4S | postgresql +12 | 12.22-1.module+el8.6.0+24068+6365202e.3 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 AUS | pg_repack | 1.4.6-3.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 AUS | pgaudit | 1.4.0-5.module+el8.5.0+11354+78b3c9c5 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 AUS | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.6 AUS | postgresql +12 | 12.22-1.module+el8.6.0+24068+6365202e.3 | RHSA-2026:4516, RHSA-2026:4505 |
| RHEL 8.4 EUS Long Life | pgaudit | 1.4.0-6.module+el8.4.0+11288+c193d6d7 | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.4 EUS Long Life | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.4 EUS Long Life | postgresql +12 | 12.22-1.module+el8.4.0+24066+665c8b71.3 | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.4 AUS | pgaudit | 1.4.0-6.module+el8.4.0+11288+c193d6d7 | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.4 AUS | postgres-decoderbufs | 0.10.0-2.module+el8.4.0+8873+b821c30a | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.4 AUS | postgresql +12 | 12.22-1.module+el8.4.0+24066+665c8b71.3 | RHSA-2026:4509, RHSA-2026:4504 |
| RHEL 8.2 AUS | pgaudit | 1.4.0-4.module+el8.2.0+9043+1dbb5661 | RHSA-2026:4506 |
| RHEL 8.2 AUS | postgres-decoderbufs | 0.10.0-2.module+el8.2.0+9043+1dbb5661 | RHSA-2026:4506 |
| RHEL 8.2 AUS | postgresql +12 | 12.22-1.module+el8.2.0+24074+a7f2beb9.3 | RHSA-2026:4506 |
| Red Hat Hardened Images 1 | postgresql18 | 18.3-1.2.hum1 | RHSA-2026:8756 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | postgresql +13 | 16.13-1.el10_2 | ALSA-2026:19010 |
| AlmaLinux 10 | postgresql-test-rpm-macros | 16.13-1.el10_1 | ALSA-2026:19010, ALSA-2026:3887 |
| AlmaLinux 10 | postgresql18 +13 | 18.3-1.el10_2 | ALSA-2026:19009 |
| AlmaLinux 9 | pg_repack | 1.4.8-2.module_el9.5.0+119+18833d03 | ALSA-2026:4110, ALSA-2026:3896 |
| AlmaLinux 9 | pgaudit | 1.7.0-1.module_el9.3.0+52+21733919 | ALSA-2026:4110, ALSA-2026:3896 |
| AlmaLinux 9 | pgvector | 0.6.2-2.module_el9.6.0+167+4e561146 | ALSA-2026:4110 |
| AlmaLinux 9 | postgis +4 | 3.5.3-3.module_el9.7.0+187+2286ff0a | ALSA-2026:4110 |
| AlmaLinux 9 | postgres-decoderbufs | 1.9.7-1.Final.module_el9.3.0+52+21733919 | ALSA-2026:4110, ALSA-2026:3896 |
| AlmaLinux 9 | postgresql +14 | 13.23-2.el9_7 | ALSA-2026:4110, ALSA-2026:3896, ALSA-2026:3730 |
| AlmaLinux 8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2026:4064, ALSA-2026:4063, ALSA-2026:4059 |
| AlmaLinux 8 | pgaudit | 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1 | ALSA-2026:4064, ALSA-2026:4063, ALSA-2026:4059 |
| AlmaLinux 8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2026:4064, ALSA-2026:4063, ALSA-2026:4059 |
| AlmaLinux 8 | postgresql +12 | 12.22-6.module_el8.10.0+4123+1638d348 | ALSA-2026:4064, ALSA-2026:4063, ALSA-2026:4059 |
| AlmaLinux 8 | postgresql-private-libs +1 | 15.17-1.module_el8.10.0+4127+dc6e3c5c | ALSA-2026:4063, ALSA-2026:4059 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | postgresql16 | 16.13-1.el10_1 | RLSA-2026:19010, RLSA-2026:3887 |
| Rocky Linux 10 | postgresql18 | 18.3-1.el10 | RLSA-2026:19009 |
| Rocky Linux 9 | pg_repack | 1.4.8-2.module+el9.7.0+40011+28af63c9 | RLSA-2026:4110, RLSA-2026:3896 |
| Rocky Linux 9 | pgaudit | 1.7.0-1.module+el9.7.0+40011+28af63c9 | RLSA-2026:4110, RLSA-2026:3896 |
| Rocky Linux 9 | pgvector | 0.6.2-2.module+el9.7.0+40012+a654bbaa | RLSA-2026:4110 |
| Rocky Linux 9 | postgis | 3.5.3-3.module+el9.7.0+40012+a654bbaa | RLSA-2026:4110 |
| Rocky Linux 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.7.0+40011+28af63c9 | RLSA-2026:4110, RLSA-2026:3896 |
| Rocky Linux 9 | postgresql | 13.23-2.el9_7 | RLSA-2026:3730 |
| Rocky Linux 8 | pg_repack | 1.4.6-3.module+el8.9.0+1594+4a6adae9 | RLSA-2026:4064, RLSA-2026:4063, RLSA-2026:4059 |
| Rocky Linux 8 | pgaudit | 1.4.0-7.module+el8.9.0+1735+a332307b | RLSA-2026:4064, RLSA-2026:4063, RLSA-2026:4059 |
| Rocky Linux 8 | postgres-decoderbufs | 0.10.0-2.module+el8.9.0+1594+4a6adae9 | RLSA-2026:4064, RLSA-2026:4063, RLSA-2026:4059 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | postgresql14 | 14.22-150600.16.28.1 | SUSE-SU-2026:0786-1 |
| SLES 15 SP7 | postgresql15 | 15.17-150600.16.28.1 | SUSE-SU-2026:0771-1 |
| SLES 15 SP7 | postgresql16 | 16.13-150600.16.30.1 | SUSE-SU-2026:0882-1 |
| SLES 15 SP7 | postgresql17 | 17.9-150600.13.24.1 | SUSE-SU-2026:0883-1 |
| SLES 15 SP7 | postgresql18 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 |
| SLES 15 SP6 | postgresql14 | 14.22-150600.16.28.1 | SUSE-SU-2026:0786-1 |
| SLES 15 SP6 | postgresql15 | 15.17-150600.16.28.1 | SUSE-SU-2026:0771-1 |
| SLES 15 SP6 | postgresql16 | 16.13-150600.16.30.1 | SUSE-SU-2026:0882-1 |
| SLES 15 SP6 | postgresql17 | 17.9-150600.13.24.1 | SUSE-SU-2026:0883-1 |
| SLES 15 SP6 | postgresql18 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 |
| SLES 15 SP5 | postgresql14 | 14.22-150200.5.69.1 | SUSE-SU-2026:0768-1 |
| SLES 15 SP5 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLES 15 SP5 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLES 15 SP5 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLES 15 SP5 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
| SLES 15 SP4 | postgresql14 | 14.22-150200.5.69.1 | SUSE-SU-2026:0768-1 |
| SLES 15 SP4 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLES 15 SP4 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLES 15 SP4 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLES 15 SP4 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
| SLES 12 SP5 | postgresql14 | 14.21-3.66.1 | SUSE-SU-2026:0616-1 |
| SLES 12 SP5 | postgresql15 | 15.16-3.50.1 | SUSE-SU-2026:0615-1 |
| SLES 12 SP5 | postgresql16 | 16.12-3.38.1 | SUSE-SU-2026:0614-1 |
| SLES 12 SP5 | postgresql18 | 18.2-8.6.1 | SUSE-SU-2026:0785-1, SUSE-SU-2026:0585-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | postgresql14 | 14.21-160000.1.1 | SUSE-SU-2026:20587-1 |
| SLES for SAP 16.0 | postgresql15 | 15.16-160000.1.1 | SUSE-SU-2026:20588-1 |
| SLES for SAP 16.0 | postgresql16 | 16.13-160000.1.1 | SUSE-SU-2026:20983-1 |
| SLES for SAP 16.0 | postgresql17 | 17.9-160000.1.1 | SUSE-SU-2026:20906-1 |
| SLES for SAP 16.0 | postgresql18 | 18.3-160000.1.1 | SUSE-SU-2026:20921-1 |
| SLES for SAP 15 SP6 | postgresql14 | 14.22-150600.16.28.1 | SUSE-SU-2026:0786-1 |
| SLES for SAP 15 SP6 | postgresql15 | 15.17-150600.16.28.1 | SUSE-SU-2026:0771-1 |
| SLES for SAP 15 SP6 | postgresql16 | 16.13-150600.16.30.1 | SUSE-SU-2026:0882-1 |
| SLES for SAP 15 SP6 | postgresql17 | 17.9-150600.13.24.1 | SUSE-SU-2026:0883-1 |
| SLES for SAP 15 SP6 | postgresql18 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 |
| SLES for SAP 15 SP5 | postgresql14 | 14.22-150200.5.69.1 | SUSE-SU-2026:0768-1 |
| SLES for SAP 15 SP5 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLES for SAP 15 SP5 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLES for SAP 15 SP5 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLES for SAP 15 SP5 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
| SLES for SAP 15 SP4 | postgresql14 | 14.22-150200.5.69.1 | SUSE-SU-2026:0768-1 |
| SLES for SAP 15 SP4 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLES for SAP 15 SP4 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLES for SAP 15 SP4 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLES for SAP 15 SP4 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
| SLES 16.0 | postgresql14 | 14.21-160000.1.1 | SUSE-SU-2026:20587-1 |
| SLES 16.0 | postgresql15 | 15.16-160000.1.1 | SUSE-SU-2026:20588-1 |
| SLES 16.0 | postgresql16 | 16.13-160000.1.1 | SUSE-SU-2026:20983-1 |
| SLES 16.0 | postgresql17 | 17.9-160000.1.1 | SUSE-SU-2026:20906-1 |
| SLES 16.0 | postgresql18 | 18.3-160000.1.1 | SUSE-SU-2026:20921-1 |
| SLE HPC 15 SP5 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLE HPC 15 SP5 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLE HPC 15 SP5 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLE HPC 15 SP5 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
| SLE HPC 15 SP4 | postgresql14 | 14.22-150200.5.69.1 | SUSE-SU-2026:0768-1 |
| SLE HPC 15 SP4 | postgresql15 | 15.17-150200.5.54.1 | SUSE-SU-2026:0770-1 |
| SLE HPC 15 SP4 | postgresql16 | 16.12-150200.5.38.1 | SUSE-SU-2026:0784-1, SUSE-SU-2026:0588-1 |
| SLE HPC 15 SP4 | postgresql17 | 17.8-150200.5.22.1 | SUSE-SU-2026:0787-1, SUSE-SU-2026:0586-1 |
| SLE HPC 15 SP4 | postgresql18 | 18.2-150200.5.6.1 | SUSE-SU-2026:0769-1, SUSE-SU-2026:0584-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql14 | 14.21-1.1 | openSUSE-SU-2026:10190-1 |
| openSUSE Tumbleweed | postgresql15 | 15.16-1.1 | openSUSE-SU-2026:10191-1 |
| openSUSE Tumbleweed | postgresql16 | 16.12-1.1 | openSUSE-SU-2026:10192-1 |
| openSUSE Tumbleweed | postgresql17 | 17.8-1.1 | openSUSE-SU-2026:10193-1 |
| openSUSE Tumbleweed | postgresql18 | 18.2-1.1 | openSUSE-SU-2026:10197-1 |
| openSUSE Leap 16.0 | postgresql14 | 14.21-160000.1.1 | openSUSE-SU-2026:20265-1 |
| openSUSE Leap 16.0 | postgresql15 | 15.16-160000.1.1 | openSUSE-SU-2026:20266-1 |
| openSUSE Leap 16.0 | postgresql16 | 16.13-160000.1.1 | openSUSE-SU-2026:20447-1 |
| openSUSE Leap 16.0 | postgresql17 | 17.9-160000.1.1 | openSUSE-SU-2026:20388-1 |
| openSUSE Leap 16.0 | postgresql18 +1 | 18.3-160000.1.1 | openSUSE-SU-2026:20408-1 |
| openSUSE Leap 15.6 | postgresql14 | 14.22-150600.16.28.1 | SUSE-SU-2026:0786-1 |
| openSUSE Leap 15.6 | postgresql15 | 15.17-150600.16.28.1 | SUSE-SU-2026:0771-1 |
| openSUSE Leap 15.6 | postgresql16 | 16.13-150600.16.30.1 | SUSE-SU-2026:0882-1 |
| openSUSE Leap 15.6 | postgresql17 | 17.9-150600.13.24.1 | SUSE-SU-2026:0883-1 |
| openSUSE Leap 15.6 | postgresql18 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | postgresql16 | 16.12-r0 | — |
| Alpine v3.24 | postgresql17 | 17.8-r0 | — |
| Alpine v3.24 | postgresql18 | 18.2-r0 | — |
| Alpine v3.23 | postgresql16 | 16.12-r0 | — |
| Alpine v3.23 | postgresql17 | 17.8-r0 | — |
| Alpine v3.23 | postgresql18 | 18.2-r0 | — |
| Alpine v3.22 | postgresql15 | 15.16-r0 | — |
| Alpine v3.22 | postgresql16 | 16.12-r0 | — |
| Alpine v3.22 | postgresql17 | 17.8-r0 | — |
| Alpine v3.21 | postgresql15 | 15.17-r0 | — |
| Alpine v3.21 | postgresql16 | 16.12-r0 | — |
| Alpine v3.21 | postgresql17 | 17.8-r0 | — |
| Alpine v3.20 | postgresql15 | 15.16-r0 | — |
| Alpine v3.20 | postgresql16 | 16.12-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | postgresql15 +15 | 15.16-1.amzn2023.0.1 | ALAS2023-2026-1456 |
| Amazon Linux 2023 | postgresql16 +15 | 16.12-1.amzn2023.0.1 | ALAS2023-2026-1458 |
| Amazon Linux 2023 | postgresql17 +15 | 17.8-1.amzn2023.0.1 | ALAS2023-2026-1457 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | postgresql | 16.12-1 | — |
| Azure Linux 3 | rust | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | postgresql | 14.21-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | postgresql +14 | 16.13-1.0.1.el10_1 | ELSA-2026-19010, ELSA-2026-3887 |
| Oracle Linux 10 | postgresql18 +13 | 18.3-1.0.1.el10_2 | ELSA-2026-19009 |
| Oracle Linux 9 | pg_repack | 1.4.8-2.module+el9.5.0+90424+300303e9 | ELSA-2026-4110, ELSA-2026-3896 |
| Oracle Linux 9 | pgaudit | 1.7.0-1.module+el9.2.0+21134+ceb95ed9 | ELSA-2026-4110, ELSA-2026-3896 |
| Oracle Linux 9 | pgvector | 0.6.2-2.module+el9.6.0+90592+523cb846 | ELSA-2026-4110 |
| Oracle Linux 9 | postgis +4 | 3.5.3-3.module+el9.7.0+90669+cd4abef7 | ELSA-2026-4110 |
| Oracle Linux 9 | postgres-decoderbufs | 1.9.7-1.Final.module+el9.2.0+21134+ceb95ed9 | ELSA-2026-4110, ELSA-2026-3896 |
| Oracle Linux 9 | postgresql +14 | 13.23-2.el9_7 | ELSA-2026-4110, ELSA-2026-3896, ELSA-2026-3730 |
| Oracle Linux 8 | pg_repack | 1.4.6-3.module+el8.9.0+90098+1560b6c2 | ELSA-2026-4063, ELSA-2026-4059, ELSA-2026-4024 |
| Oracle Linux 8 | pgaudit | 1.5.0-1.module+el8.9.0+90098+1560b6c2 | ELSA-2026-4063, ELSA-2026-4059, ELSA-2026-4024 |
| Oracle Linux 8 | postgres-decoderbufs | 0.10.0-2.module+el8.9.0+90098+1560b6c2 | ELSA-2026-4063, ELSA-2026-4059, ELSA-2026-4024 |
| Oracle Linux 8 | postgresql +12 | 12.22-6.0.1.module+el8.10.0+90836+a10460a5 | ELSA-2026-4064, ELSA-2026-4063, ELSA-2026-4059 |
| Oracle Linux 8 | postgresql-private-libs +1 | 15.17-1.module+el8.10.0+90834+1f1fb20a | ELSA-2026-4063, ELSA-2026-4059 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | postgresql-13 | 13.23-r5 | — |
Advisories 50
- ALSA-2026:3887 Important: postgresql16 security update AlmaLinux Security Advisories · Nov 9, 2026
- ALSA-2026:3730 Important: postgresql security update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2026:3896 Important: postgresql:15 security update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2026:4063 Important: postgresql:16 security update AlmaLinux Security Advisories · Nov 6, 2026
- ALSA-2026:4059 Important: postgresql:15 security update AlmaLinux Security Advisories · Nov 6, 2026
- WID-SEC-2026-2189 Dell PowerProtect Data Domain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- WID-SEC-2026-2933 Splunk SOAR: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 2, 2026
- ALSA-2026:4110 Important: postgresql:16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19010 Important: postgresql16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19009 Important: postgresql18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:4024 Important: postgresql:13 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:4064 Important: postgresql:12 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-0409 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:8756 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- WID-SEC-2026-2858 IBM AIX und VIOS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 4, 2026
- NCSC-2026-0321 Meerdere kwetsbaarheden verholpen in IBM AIX en IBM PowerVM VIOS NCSC-NL (Netherlands) · Aug 21, 2026
- RHSA-2026:19009 Red Hat Security Advisory: postgresql18 security update Red Hat Security Advisories (RHSA) · Jul 12, 2026
- ELSA-2026-19010 Important: postgresql16 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- ELSA-2026-19009 Important: postgresql18 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 8, 2026
- RHSA-2026:4548 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4547 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4544 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4546 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4515 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4441 Red Hat Security Advisory: postgresql16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4254 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4110 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4063 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4059 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:3887 Red Hat Security Advisory: postgresql16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:3896 Red Hat Security Advisory: postgresql:15 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:3730 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:19010 Red Hat Security Advisory: postgresql16 security update Red Hat Security Advisories (RHSA) · Jul 3, 2026
- RHSA-2026:4528 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4524 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4518 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4516 Red Hat Security Advisory: postgresql:13 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4506 Red Hat Security Advisory: postgresql:12 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4509 Red Hat Security Advisory: postgresql:12 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4505 Red Hat Security Advisory: postgresql:12 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4504 Red Hat Security Advisory: postgresql:13 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4475 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4075 Red Hat Security Advisory: postgresql:12 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4074 Red Hat Security Advisory: postgresql:13 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4064 Red Hat Security Advisory: postgresql:12 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RHSA-2026:4024 Red Hat Security Advisory: postgresql:13 security update Red Hat Security Advisories (RHSA) · Jun 30, 2026
- RLSA-2026:19010 Important: postgresql16 security update Rocky Linux Security Advisories · May 29, 2026
- RLSA-2026:19009 Important: postgresql18 security update Rocky Linux Security Advisories · May 29, 2026
- SUSE-SU-2026:20983-1 Security update for postgresql16 SUSE / openSUSE Security Updates · Apr 10, 2026
- openSUSE-SU-2026:20447-1 Security update for postgresql16 SUSE / openSUSE Security Updates · Apr 3, 2026