Skip to content
OpenAdvisories

Description

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Affected products

VendorProductAffectedFixed
— PostgreSQL 18 – < 18.4, 17 – < 17.10, 16 – < 16.14, 15 – < 15.18, < 14.23 18.4

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 postgresql-18 18.4-1 —
Debian 13 postgresql-17 17.10-0+deb13u1 —
Debian 12 postgresql-15 15.18-0+deb12u1 —
ReleasePackageFixed inAdvisory
Ubuntu 26.04 LTS postgresql-18 18.4-0ubuntu0.26.04.1 —
Ubuntu 25.10 postgresql-17 17.10-0ubuntu0.25.10.1 —
Ubuntu 24.04 LTS postgresql-16 16.14-0ubuntu0.24.04.1 —
Ubuntu 22.04 LTS postgresql-14 14.23-0ubuntu0.22.04.1 —
Ubuntu 20.04 LTS postgresql-12 No fix yet —
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS postgresql-10 No fix yet —
Ubuntu Pro 16.04 LTS postgresql-9.5 No fix yet —
Ubuntu Pro 14.04 LTS postgresql-9.3 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 postgresql +15 16.14-1.el10_2 RHSA-2026:27743
RHEL 10 postgresql18 +13 18.4-1.el10_2 RHSA-2026:27742
RHEL 9 pg_repack 1.4.8-2.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgaudit 1.7.0-1.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 pgvector 0.6.2-2.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgis +4 3.5.3-5.module+el9.8.0+24090+8f0ee565 RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgres-decoderbufs 1.9.7-1.Final.module+el9.8.0+24091+17775505 RHSA-2026:28037, RHSA-2026:26204, RHSA-2026:26203
RHEL 9 postgresql +14 13.23-3.el9_8 RHSA-2026:28037, RHSA-2026:27741, RHSA-2026:26204
RHEL 8 pg_repack 1.4.6-3.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 pgaudit 1.4.0-7.module+el8.10.0+22214+9beb89d6 RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgres-decoderbufs 0.10.0-2.module+el8.9.0+19330+c97ddbdf RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql +12 12.22-7.module+el8.10.0+24362+fcf88eed RHSA-2026:28999, RHSA-2026:28208, RHSA-2026:28143
RHEL 8 postgresql-private-libs +1 15.18-1.module+el8.10.0+24361+29e043a0 RHSA-2026:28143, RHSA-2026:26181
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 10.0 EUS postgresql +15 16.14-1.el10_0 RHSA-2026:27718
RHEL 9.6 EUS pg_repack 1.4.8-2.module+el9.5.0+22224+f5585c78 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS pgvector 0.6.2-2.module+el9.6.0+22979+c3d78d52 RHSA-2026:26525
RHEL 9.6 EUS postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:32983, RHSA-2026:26525
RHEL 9.6 EUS postgresql +14 13.23-1.el9_6.2 RHSA-2026:50119, RHSA-2026:32983, RHSA-2026:29212
RHEL 9.4 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33441, RHSA-2026:26524
RHEL 9.4 E4S postgresql +7 13.23-1.el9_4.2 RHSA-2026:33441, RHSA-2026:29904, RHSA-2026:26524
RHEL 9.4 E4S postgresql-docs +6 15.18-1.module+el9.4.0+24401+d70df5dc RHSA-2026:33441, RHSA-2026:26524
RHEL 9.2 E4S pg_repack 1.4.8-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S pgaudit 1.7.0-1.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgres-decoderbufs 1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60 RHSA-2026:33497
RHEL 9.2 E4S postgresql +7 13.23-1.el9_2.2 RHSA-2026:50811, RHSA-2026:33497, RHSA-2026:29953
RHEL 9.2 E4S postgresql-docs +6 15.18-1.module+el9.2.0+24451+e803ec54 RHSA-2026:33497
RHEL 8.8 TUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 TUS postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.8 E4S pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql +12 12.22-1.module+el8.8.0+24458+21f81c54.4 RHSA-2026:42555, RHSA-2026:34043, RHSA-2026:26561
RHEL 8.8 E4S postgresql-private-libs +1 15.18-1.module+el8.8.0+24395+e7b9b4b6 RHSA-2026:26561
RHEL 8.6 EUS Long Life pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 EUS Long Life postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pg_repack 1.4.6-3.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS pgaudit 1.4.0-5.module+el8.5.0+11354+78b3c9c5 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:32994, RHSA-2026:29815
RHEL 8.6 AUS postgresql +12 12.22-1.module+el8.6.0+24433+21669af6.4 RHSA-2026:32994, RHSA-2026:29815
RHEL 8.4 EUS Long Life pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 EUS Long Life postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS pgaudit 1.4.0-6.module+el8.4.0+11288+c193d6d7 RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgres-decoderbufs 0.10.0-2.module+el8.4.0+8873+b821c30a RHSA-2026:34363, RHSA-2026:34362
RHEL 8.4 AUS postgresql +12 12.22-1.module+el8.4.0+24442+74e4dc28.4 RHSA-2026:34363, RHSA-2026:34362
RHEL 7 ELS postgresql +11 9.2.24-9.el7_9.6 RHSA-2026:49521
Red Hat Hardened Images 1 postgresql +14 18.4-0.1.hum1 RHSA-2026:22878
Red Hat Hardened Images 1 postgresql17 +14 17.10-0.1.hum1 RHSA-2026:21182

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 postgresql +14 16.14-1.el10_2 ALSA-2026:27743
AlmaLinux 10 postgresql18 +13 18.4-1.el10_2 ALSA-2026:27742
AlmaLinux 9 pg_repack 1.4.8-2.module_el9.5.0+119+18833d03 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgaudit 1.7.0-1.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 pgvector 0.6.2-2.module_el9.6.0+167+4e561146 ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgis +4 3.5.3-5.module_el9.8.0+236+2d3cbd4c ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgres-decoderbufs 1.9.7-1.Final.module_el9.3.0+52+21733919 ALSA-2026:28037, ALSA-2026:26204, ALSA-2026:26203
AlmaLinux 9 postgresql +14 13.23-3.el9_8 ALSA-2026:28037, ALSA-2026:27741, ALSA-2026:26204
AlmaLinux 8 pg_repack 1.4.6-3.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 pgaudit 1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgres-decoderbufs 0.10.0-2.module_el8.6.0+2760+1746ec94 ALSA-2026:28999, ALSA-2026:28208, ALSA-2026:28143
AlmaLinux 8 postgresql +12 13.23-3.module_el8.10.0+4198+7a62a2ce ALSA-2026:28208, ALSA-2026:28143, ALSA-2026:26181
AlmaLinux 8 postgresql-private-libs +1 15.18-1.module_el8.10.0+4195+4569d728 ALSA-2026:28143, ALSA-2026:26181

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 9 postgresql 13.23-3.el9_8 RLSA-2026:27741
ReleasePackageFixed inAdvisory
SLES for SAP 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES for SAP 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES for SAP 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES for SAP 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES for SAP 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
SLES 16.0 postgresql14 14.23-160000.1.1 SUSE-SU-2026:22177-1
SLES 16.0 postgresql15 15.18-160000.1.1 SUSE-SU-2026:22183-1
SLES 16.0 postgresql16 16.14-160000.1.1 SUSE-SU-2026:22184-1
SLES 16.0 postgresql17 17.10-160000.1.1 SUSE-SU-2026:22149-1
SLES 16.0 postgresql18 18.4-160000.1.1 SUSE-SU-2026:22077-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed postgresql14 14.23-1.1 openSUSE-SU-2026:10806-1
openSUSE Tumbleweed postgresql15 15.18-1.1 openSUSE-SU-2026:10807-1
openSUSE Tumbleweed postgresql16 16.14-1.1 openSUSE-SU-2026:10808-1
openSUSE Tumbleweed postgresql17 17.10-1.1 openSUSE-SU-2026:10809-1
openSUSE Tumbleweed postgresql18 18.4-1.1 openSUSE-SU-2026:10828-1
openSUSE Leap 16.0 postgresql14 14.23-160000.1.1 openSUSE-SU-2026:21102-1
openSUSE Leap 16.0 postgresql15 15.18-160000.1.1 openSUSE-SU-2026:21103-1
openSUSE Leap 16.0 postgresql16 16.14-160000.1.1 openSUSE-SU-2026:21104-1
openSUSE Leap 16.0 postgresql17 17.10-160000.1.1 openSUSE-SU-2026:20970-1
ReleasePackageFixed inAdvisory
Alpine v3.24 postgresql16 16.14-r0 —
Alpine v3.24 postgresql17 17.10-r0 —
Alpine v3.24 postgresql18 18.4-r0 —
Alpine v3.23 postgresql16 16.14-r0 —
Alpine v3.23 postgresql17 17.10-r0 —
Alpine v3.23 postgresql18 18.4-r0 —
Alpine v3.22 postgresql15 15.18-r0 —
Alpine v3.22 postgresql16 16.14-r0 —
Alpine v3.22 postgresql17 17.10-r0 —
Alpine v3.21 postgresql15 15.18-r0 —
Alpine v3.21 postgresql16 16.14-r0 —
Alpine v3.21 postgresql17 17.10-r0 —
Alpine v3.20 postgresql15 15.18-r0 —
Alpine v3.20 postgresql16 16.14-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 postgresql15 +15 15.18-1.amzn2023.0.1 ALAS2023-2026-1768
Amazon Linux 2023 postgresql16 +15 16.14-1.amzn2023.0.1 ALAS2023-2026-1767
Amazon Linux 2023 postgresql17 +15 17.10-1.amzn2023.0.1 ALAS2023-2026-1766
Amazon Linux 2023 postgresql18 +15 18.4-1.amzn2023.0.1 ALAS2023-2026-1780
Amazon Linux 2 postgresql +11 9.2.24-8.amzn2.0.10 ALAS2-2026-3344

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 postgresql 16.14-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 postgresql18 +13 18.4-1.0.1.el10_2 ELSA-2026-27742

Advisories 50

References