Skip to content
OpenAdvisories
Medium · 6.5 CVE-2026-61822 EUVD-2026-83422

pg_partman disable maintenance for all partition sets

Published Sep 18, 2026 · Updated Sep 24, 2026 · Assigned by GitHub_M

Description

pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions outside the loop that processes rows from part_config, so an exception for one partition set immediately terminates the loop and skips every later set. A role with partman_user access can insert or update a row that reliably fails and assign it a low maintenance_order value so it is processed before legitimate rows. Repeated maintenance ticks then abort before legitimate partition sets are maintained, causing database-wide loss of automated partition maintenance. This issue is fixed in version 5.5.0.

Affected products

VendorProductAffectedFixed
pgpartman pg_partman < 5.5.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 pg-partman 5.5.0-1 —
Debian 13 pg-partman No fix yet —
Debian 12 pg-partman No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS pg-partman No fix yet —
Ubuntu 24.04 LTS pg-partman No fix yet —
Ubuntu 22.04 LTS pg-partman No fix yet —
Ubuntu 20.04 LTS pg-partman No fix yet —
Ubuntu 18.04 LTS pg-partman No fix yet —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS pg-partman No fix yet —

Advisories 1

References