Skip to content
OpenAdvisories

Description

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

VendorProductAffectedFixed
— PostgreSQL 18 – < 18.4, 17 – < 17.10, 16 – < 16.14, 15 – < 15.18, < 14.23 18.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 postgresql-18 18.4-1 —
Debian 13 postgresql-17 17.10-0+deb13u1 —
Debian 12 postgresql-15 15.18-0+deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS postgresql-18 18.4-0ubuntu0.26.04.1 —
Ubuntu 25.10 postgresql-17 17.10-0ubuntu0.25.10.1 —
Ubuntu 24.04 LTS postgresql-16 16.14-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS postgresql-14 14.23-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS postgresql-12 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS postgresql-10 No fix yet —
Ubuntu Pro 16.04 LTS postgresql-9.5 No fix yet —
Ubuntu Pro 14.04 LTS postgresql-9.3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 postgresql +15 16.14-1.el10_2 RHSA-2026:27743
RHEL 10 postgresql18 +13 18.4-1.el10_2 RHSA-2026:27742
RHEL 9 pg_repack 1.4.8-2.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgaudit 1.7.0-1.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgvector 0.6.2-2.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgis +4 3.5.3-5.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgresql +14 13.23-3.el9_8 RHSA-2026:28037, RHSA-2026:27741, RHSA-2026:26204
RHEL 8 libpq +1 13.23-2.el8_10 RHSA-2026:27738
RHEL 8 pg_repack 1.4.6-3.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 pgaudit 1.4.0-7.module+el8.10.0+22214+9beb89d6 RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgres-decoderbufs 0.10.0-2.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql +12 12.22-7.module+el8.10.0+24362+fcf88eed RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql-private-libs +1 15.18-1.module+el8.10.0+24361+29e043a0 RHSA-2026:28143, RHSA-2026:26181
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS postgresql +15 16.14-1.el10_0 RHSA-2026:27718
RHEL 9.6 EUS pg_repack 1.4.8-2.module+el9.5.0+22224+f5585c78 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgvector 0.6.2-2.module+el9.6.0+22979+c3d78d52 RHSA-2026:26525
RHEL 9.6 EUS postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS postgresql +14 13.23-1.el9_6.2 RHSA-2026:32983, RHSA-2026:29212, RHSA-2026:26525
RHEL 9.4 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgresql +7 13.23-1.el9_4.2 RHSA-2026:33441, RHSA-2026:29904, RHSA-2026:26524
RHEL 9.4 E4S postgresql-docs +6 15.18-1.module+el9.4.0+24401+d70df5dc RHSA-2026:33441, RHSA-2026:26524
RHEL 9.2 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgresql +7 13.23-1.el9_2.2 RHSA-2026:33497, RHSA-2026:29953
RHEL 9.2 E4S postgresql-docs +6 15.18-1.module+el9.2.0+24451+e803ec54 RHSA-2026:33497
RHEL 8.8 TUS libpq +1 13.23-1.el8_8.1 RHSA-2026:35880
RHEL 8.8 TUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.8 E4S libpq +1 13.23-1.el8_8.1 RHSA-2026:35880
RHEL 8.8 E4S pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.6 EUS Long Life pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.4 EUS Long Life libpq +1 13.23-1.el8_4.1 RHSA-2026:44420
RHEL 8.4 EUS Long Life pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS libpq +1 13.23-1.el8_4.1 RHSA-2026:44420
RHEL 8.4 AUS pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
RHEL 7 ELS postgresql +11 9.2.24-9.el7_9.6 RHSA-2026:49521
Red Hat Hardened Images 1 postgresql +14 18.4-0.1.hum1 RHSA-2026:22878
Red Hat Hardened Images 1 postgresql17 +14 17.10-0.1.hum1 RHSA-2026:21182

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 postgresql +14 16.14-1.el10_2 ALSA-2026:27743
AlmaLinux 10 postgresql18 +13 18.4-1.el10_2 ALSA-2026:27742
AlmaLinux 9 pg_repack 1.4.8-2.module_el9.5.0+119+18833d03 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgaudit 1.7.0-1.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgvector 0.6.2-2.module_el9.6.0+167+4e561146 ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgis +4 3.5.3-5.module_el9.8.0+236+2d3cbd4c ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgres-decoderbufs 1.9.7-1.Final.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgresql +14 13.23-3.el9_8 ALSA-2026:28037, ALSA-2026:27741, ALSA-2026:26204
AlmaLinux 8 libpq +1 13.23-2.el8_10 ALSA-2026:27738
AlmaLinux 8 pg_repack 1.4.6-3.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 pgaudit 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgres-decoderbufs 0.10.0-2.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgresql +12 13.23-3.module_el8.10.0+4198+7a62a2ce ALSA-2026:28208, ALSA-2026:28143, ALSA-2026:26181
AlmaLinux 8 postgresql-private-libs +1 15.18-1.module_el8.10.0+4195+4569d728 ALSA-2026:28143, ALSA-2026:26181

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 postgresql16 16.14-1.el10_2 RLSA-2026:27743
Rocky Linux 10 postgresql18 18.4-1.el10_2 RLSA-2026:27742
Rocky Linux 9 pg_repack 1.4.8-2.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 pgaudit 1.7.0-1.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 pgvector 0.6.2-2.module+el9.8.0+40159+adcaa225 RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgis 3.5.3-5.module+el9.8.0+40163+45adab57 RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.7.0+40011+28af63c9 RLSA-2026:28037, RLSA-2026:26204, RLSA-2026:26203
Rocky Linux 9 postgresql 13.23-3.el9_8 RLSA-2026:27741
Rocky Linux 8 libpq 13.23-2.el8_10 RLSA-2026:27738
Rocky Linux 8 pg_repack 1.4.6-3.module+el8.9.0+1594+4a6adae9 RLSA-2026:28999, RLSA-2026:28208, RLSA-2026:28143
Rocky Linux 8 pgaudit 1.4.0-7.module+el8.9.0+1735+a332307b RLSA-2026:28999, RLSA-2026:28208, RLSA-2026:28143
Rocky Linux 8 postgres-decoderbufs 0.10.0-2.module+el8.9.0+1594+4a6adae9 RLSA-2026:28999, RLSA-2026:28208, RLSA-2026:28143
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES for SAP 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES for SAP 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES for SAP 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES for SAP 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
SLES 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql14 14.23-1.1 openSUSE-SU-2026:10806-1
openSUSE Tumbleweed postgresql15 15.18-1.1 openSUSE-SU-2026:10807-1
openSUSE Tumbleweed postgresql16 16.14-1.1 openSUSE-SU-2026:10808-1
openSUSE Tumbleweed postgresql17 17.10-1.1 openSUSE-SU-2026:10809-1
openSUSE Tumbleweed postgresql18 18.4-1.1 openSUSE-SU-2026:10828-1
openSUSE Leap 16.0 postgresql14 14.23-160000.1.1 openSUSE-SU-2026:21102-1
openSUSE Leap 16.0 postgresql15 15.18-160000.1.1 openSUSE-SU-2026:21103-1
openSUSE Leap 16.0 postgresql16 16.14-160000.1.1 openSUSE-SU-2026:21104-1
openSUSE Leap 16.0 postgresql17 17.10-160000.1.1 openSUSE-SU-2026:20970-1
ReleasePackageFixed inAdvisory
Alpine v3.24 postgresql16 16.14-r0 —
Alpine v3.24 postgresql17 17.10-r0 —
Alpine v3.24 postgresql18 18.4-r0 —
Alpine v3.23 postgresql16 16.14-r0 —
Alpine v3.23 postgresql17 17.10-r0 —
Alpine v3.23 postgresql18 18.4-r0 —
Alpine v3.22 postgresql15 15.18-r0 —
Alpine v3.22 postgresql16 16.14-r0 —
Alpine v3.22 postgresql17 17.10-r0 —
Alpine v3.21 postgresql15 15.18-r0 —
Alpine v3.21 postgresql16 16.14-r0 —
Alpine v3.21 postgresql17 17.10-r0 —
Alpine v3.20 postgresql15 15.18-r0 —
Alpine v3.20 postgresql16 16.14-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libpq +17 18.4-1.amzn2023.0.1 ALAS2023-2026-1780, ALAS2023-2026-1711
Amazon Linux 2023 postgresql15 +15 15.18-1.amzn2023.0.1 ALAS2023-2026-1768
Amazon Linux 2023 postgresql16 +15 16.14-1.amzn2023.0.1 ALAS2023-2026-1767
Amazon Linux 2023 postgresql17 +15 17.10-1.amzn2023.0.1 ALAS2023-2026-1766

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 postgresql 16.14-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 postgresql +14 16.14-1.0.1.el10_2 ELSA-2026-27743
Oracle Linux 10 postgresql18 +13 18.4-1.0.1.el10_2 ELSA-2026-27742
Oracle Linux 9 pg_repack 1.4.8-2.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 pgaudit 1.7.0-1.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 pgvector 0.6.2-2.module+el9.8.0+90925+e22a792e ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgis +4 3.5.3-5.module+el9.8.0+90925+e22a792e ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.8.0+90926+92e334e4 ELSA-2026-28037, ELSA-2026-26204, ELSA-2026-26203
Oracle Linux 9 postgresql +14 13.23-3.el9_8 ELSA-2026-28037, ELSA-2026-27741, ELSA-2026-26204
Oracle Linux 8 libpq +1 13.23-2.el8_10 ELSA-2026-27738
Oracle Linux 8 pg_repack 1.4.6-3.module+el8.9.0+90098+1560b6c2 ELSA-2026-28208, ELSA-2026-28143, ELSA-2026-26181
Oracle Linux 8 pgaudit 1.5.0-1.module+el8.9.0+90098+1560b6c2 ELSA-2026-28208, ELSA-2026-28143, ELSA-2026-26181
Oracle Linux 8 postgres-decoderbufs 0.10.0-2.module+el8.9.0+90098+1560b6c2 ELSA-2026-28208, ELSA-2026-28143, ELSA-2026-26181
Oracle Linux 8 postgresql +12 12.22-6.0.1.module+el8.10.0+90932+f6d78e3c ELSA-2026-28999, ELSA-2026-28208, ELSA-2026-28143
Oracle Linux 8 postgresql-private-libs +1 15.18-1.module+el8.10.0+90918+5e9abb9f ELSA-2026-28143, ELSA-2026-26181

Advisories 50

References