Description
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PostgreSQL | 18 – < 18.4 | 18.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgresql-18 | 18.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | postgresql-18 | 18.4-0ubuntu0.26.04.1 | — |
| Ubuntu 25.10 | postgresql-17 | 17.10-0ubuntu0.25.10.1 | — |
| Ubuntu 24.04 LTS | postgresql-16 | 16.14-0ubuntu0.24.04.1 | — |
| Ubuntu 22.04 LTS | postgresql-14 | 14.23-0ubuntu0.22.04.1 | — |
| Ubuntu 20.04 LTS | postgresql-12 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | postgresql-10 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | postgresql-9.5 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | postgresql-9.3 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | postgresql18 +13 | 18.4-1.el10_2 | RHSA-2026:27742 |
| RHEL 9 | pg_repack | 1.5.3-1.module+el9.8.0+23739+1c42644c | RHSA-2026:26204 |
| RHEL 9 | pgaudit | 18.0-1.module+el9.8.0+23739+1c42644c | RHSA-2026:26204 |
| RHEL 9 | pgvector | 0.8.1-1.module+el9.8.0+23739+1c42644c | RHSA-2026:26204 |
| RHEL 9 | postgis +4 | 3.6.1-2.module+el9.8.0+23739+1c42644c | RHSA-2026:26204 |
| RHEL 9 | postgres-decoderbufs | 3.3.1-1.Final.module+el9.8.0+23739+1c42644c | RHSA-2026:26204 |
| RHEL 9 | postgresql +14 | 18.4-2.module+el9.8.0+24359+da7fad50 | RHSA-2026:26204 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | postgresql +14 | 18.4-0.1.hum1 | RHSA-2026:22878 |
| Red Hat Hardened Images 1 | postgresql17 +14 | 17.10-0.1.hum1 | RHSA-2026:21182 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | postgresql18 +13 | 18.4-1.el10_2 | ALSA-2026:27742 |
| AlmaLinux 9 | pg_repack | 1.5.3-1.module_el9.8.0+234+5456f35d | ALSA-2026:26204 |
| AlmaLinux 9 | pgaudit | 18.0-1.module_el9.8.0+234+5456f35d | ALSA-2026:26204 |
| AlmaLinux 9 | pgvector | 0.8.1-1.module_el9.8.0+234+5456f35d | ALSA-2026:26204 |
| AlmaLinux 9 | postgis +4 | 3.6.1-2.module_el9.8.0+239+6fb51d38 | ALSA-2026:26204 |
| AlmaLinux 9 | postgres-decoderbufs | 3.3.1-1.Final.module_el9.8.0+234+5456f35d | ALSA-2026:26204 |
| AlmaLinux 9 | postgresql +14 | 18.4-2.module_el9.8.0+280+5ad12178 | ALSA-2026:26204 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
| SLES 16.0 | postgresql18 | 18.4-160000.1.1 | SUSE-SU-2026:22077-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | postgresql18 | 18.4-1.1 | openSUSE-SU-2026:10828-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | postgresql18 | 18.4-r0 | — |
| Alpine v3.23 | postgresql18 | 18.4-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | postgresql18 +15 | 18.4-1.amzn2023.0.1 | ALAS2023-2026-1780 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | postgresql18 +13 | 18.4-1.0.1.el10_2 | ELSA-2026-27742 |
Advisories 11
- ALSA-2026:27742 Important: postgresql18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:26204 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2026-1544 PostgreSQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 21, 2026
- RHSA-2026:27742 Red Hat Security Advisory: postgresql18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:26204 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2026:21182 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:22878 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- ELSA-2026-27742 Important: postgresql18 security update (Oracle Linux 10) Oracle Linux Security Advisories (ELSA) · Jul 17, 2026
- SUSE-SU-2026:22077-1 Security update for postgresql18 SUSE / openSUSE Security Updates · Jun 16, 2026
- ALAS2023-2026-1780 Important: postgresql18 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Jun 8, 2026
- openSUSE-SU-2026:10828-1 libecpg6-18.4-1.1 on GA media SUSE / openSUSE Security Updates · May 21, 2026