Description
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PostGIS | PostGIS | < 3.7.0beta2 | 3.7.0beta2 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postgis | 3.7.0+dfsg-1 | — |
| Debian 13 | postgis | No fix yet | — |
| Debian 12 | postgis | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | postgis | No fix yet | — |
| Ubuntu 26.04 LTS | postgis | No fix yet | — |
| Ubuntu 24.04 LTS | postgis | No fix yet | — |
| Ubuntu 22.04 LTS | postgis | No fix yet | — |
| Ubuntu 20.04 LTS | postgis | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | postgis | No fix yet | — |
| Ubuntu 16.04 LTS | postgis | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | postgis +5 | 3.5.3-4.el10_2.1 | RHSA-2026:65899 |
| RHEL 10 | postgresql18-postgis +4 | 3.5.3-1.el10_2.1 | RHSA-2026:67166 |
| RHEL 9 | pg_repack | 1.5.1-1.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
| RHEL 9 | pgaudit | 16.0-1.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
| RHEL 9 | pgvector | 0.6.2-2.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
| RHEL 9 | postgis +4 | 3.5.3-6.module+el9.8.0+24839+3a67b9ca | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
| RHEL 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+24090+8f0ee565 | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
| RHEL 9 | postgresql +14 | 16.15-1.module+el9.8.0+24803+9dca000b | RHSA-2026:97875, RHSA-2026:67848, RHSA-2026:67491 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | postgis +4 | 3.5.3-4.el10_2.1 | ALSA-2026:65899 |
| AlmaLinux 10 | postgresql18-postgis +4 | 3.5.3-1.el10_2.1 | ALSA-2026:67166 |
| AlmaLinux 9 | pg_repack | 1.5.1-1.module_el9.6.0+146+c54fdeca | ALSA-2026:67848, ALSA-2026:67491 |
| AlmaLinux 9 | pgaudit | 16.0-1.module_el9.4.0+66+eb9878bc | ALSA-2026:67848, ALSA-2026:67491 |
| AlmaLinux 9 | pgvector | 0.6.2-2.module_el9.6.0+167+4e561146 | ALSA-2026:67848, ALSA-2026:67491 |
| AlmaLinux 9 | postgis +4 | 3.5.3-6.module_el9.8.0+311+c39b793b | ALSA-2026:67848, ALSA-2026:67491 |
| AlmaLinux 9 | postgres-decoderbufs | 2.4.0-1.Final.module_el9.4.0+66+eb9878bc | ALSA-2026:67848, ALSA-2026:67491 |
| AlmaLinux 9 | postgresql +14 | 16.15-1.module_el9.8.0+311+c39b793b | ALSA-2026:67848, ALSA-2026:67491 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | postgresql16-postgis | 3.5.3-4.el10_2.1 | RLSA-2026:65899 |
| Rocky Linux 10 | postgresql18-postgis | 3.5.3-1.el10_2.1 | RLSA-2026:67166 |
| Rocky Linux 9 | pg_repack | 1.5.1-1.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:67848, RLSA-2026:67491 |
| Rocky Linux 9 | pgaudit | 16.0-1.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:67848, RLSA-2026:67491 |
| Rocky Linux 9 | pgvector | 0.6.2-2.module+el9.8.0+40159+adcaa225 | RLSA-2026:67848, RLSA-2026:67491 |
| Rocky Linux 9 | postgis | 3.5.3-6.module+el9.8.0+40320+f6f9ed3c | RLSA-2026:97875 |
| Rocky Linux 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+40159+adcaa225 | RLSA-2026:97875, RLSA-2026:67848, RLSA-2026:67491 |
| Rocky Linux 9 | postgresql | 16.15-1.module+el9.8.0+40320+f6f9ed3c | RLSA-2026:97875 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | pg_repack | 1.5.1-1.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
| Oracle Linux 9 | pgaudit | 16.0-1.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
| Oracle Linux 9 | pgvector | 0.6.2-2.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
| Oracle Linux 9 | postgis +4 | 3.5.3-6.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
| Oracle Linux 9 | postgres-decoderbufs | 2.4.0-1.Final.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
| Oracle Linux 9 | postgresql +14 | 16.15-1.module+el9.8.0+91036+1d936f05 | ELSA-2026-67848, ELSA-2026-67491 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | postgis-18 | 3.7.0-r0 | — |
Advisories 17
- RHSA-2026:97875 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RLSA-2026:97875 Important: postgresql:16 security update Rocky Linux Security Advisories · Nov 11, 2026
- WID-SEC-2026-3306 Red Hat Enterprise Linux (postgis, virtuoso-opensource): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- ALSA-2026:67491 Important: postgresql:16 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67848 Important: postgresql:18 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:65899 Important: postgresql16-postgis security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:67166 Important: postgresql18-postgis security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2026:67848 Red Hat Security Advisory: postgresql:18 security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:67491 Red Hat Security Advisory: postgresql:16 security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2026:67166 Red Hat Security Advisory: postgresql18-postgis security update Red Hat Security Advisories (RHSA) · Oct 6, 2026
- RHSA-2026:65899 Red Hat Security Advisory: postgresql16-postgis security update Red Hat Security Advisories (RHSA) · Sep 17, 2026
- RLSA-2026:67848 Important: postgresql:18 security update Rocky Linux Security Advisories · Sep 16, 2026
- ELSA-2026-67491 Important: postgresql:16 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 16, 2026
- ELSA-2026-67848 Important: postgresql:18 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Sep 16, 2026
- RLSA-2026:67166 Important: postgresql18-postgis security update Rocky Linux Security Advisories · Sep 15, 2026
- RLSA-2026:67491 Important: postgresql:16 security update Rocky Linux Security Advisories · Sep 15, 2026
- RLSA-2026:65899 Important: postgresql16-postgis security update Rocky Linux Security Advisories · Sep 10, 2026
References
- Researcher Blog technical-description exploit
- Changelog release-notes
- https://www.vulncheck.com/advisories/postgis-0beta2-out-of-bounds-read-via-flatgeobuf-buffer third-party-advisory