SB2026081506 - Debian update for postgresql-17
Published: August 15, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 27 vulnerabilities.
1) Observable discrepancy (CVE-ID: CVE-2026-14672)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper information exposure in the SCRAM authentication mechanism when handling authentication requests. A remote attacker can observe the SCRAM iteration count in the authentication challenge to disclose sensitive information.
The issue can be used to test whether a user exists only if the probed user has a non-default scram_iterations count.
2) Heap-based buffer overflow (CVE-ID: CVE-2026-19385)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in pg_dump when processing long function transform lists. A remote user can create a crafted transform list to execute arbitrary code.
Code execution occurs as the operating system user running pg_dump.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to improper neutralization of special elements in pg_dump and related dump-generation tools when processing untrusted server-side data for restore in psql. A remote attacker can inject arbitrary code into a dump file to execute arbitrary code.
User interaction is required to restore the crafted dump with psql.
4) Out-of-bounds read (CVE-ID: CVE-2026-18024)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the ascii() SQL function when processing a crafted text value. A remote user can supply a crafted text value to disclose sensitive information.
Successful exploitation can disclose up to 3 bytes after the end of a specific allocation.
5) Integer underflow (CVE-ID: CVE-2026-16241)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to integer underflow in the ECPG client when processing a bytea value lacking the mandatory prefix. A remote privileged user can send a specially crafted bytea value to cause a denial of service.
In rare cases, the overwrite may also cause limited client-specific integrity impact.
6) Type Confusion (CVE-ID: CVE-2026-16239)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the portal/cursor lifecycle when re-creating a cursor or other portal with different types. A remote user can re-create a cursor or other portal with different types to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
7) Integer overflow (CVE-ID: CVE-2026-15742)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in the fuzzystrmatch levenshtein() and levenshtein_less_equal() functions when processing extreme SQL inputs. A remote user can supply crafted input values to direct writes to a huge range of addresses and execute arbitrary code.
Code execution occurs as the operating system user running the database.
8) SQL injection (CVE-ID: CVE-2026-15741)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary SQL as a superuser.
The vulnerability exists due to SQL injection in EXTRACT() expression deparse when processing a hostile object definition. A remote attacker can create a crafted object definition to execute arbitrary SQL as a superuser.
User interaction is required when a victim uses an expression deparse consumer such as pg_dump, psql \sf, or a similar non-core tool.
9) Improper access control (CVE-ID: CVE-2026-14681)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to negotiate a connection with lesser protection than required and weaken message integrity protections.
The vulnerability exists due to improper enforcement of message integrity in PostgreSQL GSSAPI support when establishing an initial direct TLS connection. A remote user can negotiate GSSAPI contrary to pg_hba.conf rules to negotiate a connection with lesser protection than required and weaken message integrity protections.
The issue occurs when TLS settings are more permissive than the GSS settings.
10) Type Confusion (CVE-ID: CVE-2026-14680)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in functions with "internal" argument types when invoking such functions from SQL. A remote user can call functions with that argument type to execute arbitrary code.
Successful exploitation can run code as the operating system user running the database.
11) Stack-based buffer overflow (CVE-ID: CVE-2026-14679)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service and modify server memory.
The vulnerability exists due to stack-based buffer overflow in PostgreSQL argument name matching when processing crafted OUT parameter counts. A remote attacker can create an object with crafted parameters to cause a denial of service and modify server memory.
The memory write is limited to 0x0 and 0x1 byte values.
12) Out-of-bounds read (CVE-ID: CVE-2026-14678)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose limited memory values.
The vulnerability exists due to an out-of-bounds read in the pg_trgm index picksplit function when processing index split operations. A remote user can maintain a table to infer limited memory values via the lossy signal of index split choices.
13) Integer overflow (CVE-ID: CVE-2026-14677)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in pltcl and plperl when processing crafted function bodies on 32-bit builds. A remote user can create a crafted function body to execute arbitrary code.
Only 32-bit builds are vulnerable.
14) Untrusted search path (CVE-ID: CVE-2026-14673)
CWE-ID: CWE-426 - Untrusted Search Path
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary functions with the privileges of expression index owners.
The vulnerability exists due to improper control of search path in amcheck functions when invoking amcheck with a hostile search path. A remote privileged user can set a hostile search path before calling the amcheck function to execute arbitrary functions with the privileges of expression index owners.
Exploitation requires EXECUTE privilege on the amcheck function and affects expression indexes that depend on the search path.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute psql commands.
The vulnerability exists due to untrusted data inclusion in psql COPY FROM STDIN handling when a COPY FROM STDIN or \\copy FROM STDIN command fails before the server indicates that it awaits input rows. A remote attacker can trigger an early failure so that in-line data rows are processed as psql commands to execute psql commands.
A complete attack requires control of both the server and the data rows, although an attacker controlling only the data rows might succeed if a coincidental error occurs.
16) Type Confusion (CVE-ID: CVE-2026-14671)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the refint module plan cache when processing object definitions created in the module. A remote user can create a crafted object to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
17) Heap-based buffer overflow (CVE-ID: CVE-2026-14670)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in the PostgreSQL plperl tied hash return handling when processing a crafted function body that returns a tied hash. A remote user can create a crafted function body to execute arbitrary code.
The code executes as the operating system user running the database.
18) Heap-based buffer overflow (CVE-ID: CVE-2026-14669)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in to_char(timestamptz) when processing a long POSIX timezone abbreviation. A remote user can supply a crafted timezone value to execute arbitrary code.
The code executes as the operating system user running the database.
19) Type Confusion (CVE-ID: CVE-2026-14668)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.
The vulnerability exists due to type confusion in the ctid data type selectivity estimator when processing a chosen non-ctid input. A remote user can create an object with crafted input to disclose sensitive information and cause a denial of service.
The disclosed value is a calculation derived from an arbitrary 4-byte span of memory, and substantial memory value recovery appears possible despite loss of precision.
20) Missing Authorization (CVE-ID: CVE-2026-14666)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass row-level security restrictions and access or modify data that should no longer be permitted.
The vulnerability exists due to incomplete tracking of role membership, role attribute, and database ownership changes in PostgreSQL row-level security policy caching when reusing query plans. A remote user can reuse a cached plan after privilege or role changes to bypass row-level security restrictions and access or modify data that should no longer be permitted.
Exploitation requires tailoring the attack to an application's pattern of privilege removal and role-specific row security policies, and stale policies persist until cache invalidation or session termination.
21) Heap-based buffer overflow (CVE-ID: CVE-2026-14664)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in PostgreSQL regexp processing when processing text that would not pass encoding validation. A remote user can supply a crafted query containing such text to execute arbitrary code.
Successful exploitation can occur in the context of the operating system user running the database.
22) Missing Encryption of Sensitive Data (CVE-ID: CVE-2026-14663)
CWE-ID: CWE-311 - Missing Encryption of Sensitive Data
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose cleartext data and tamper with encrypted data.
The vulnerability exists due to improper encryption in pgcrypto functions when processing OpenSSL-disabled ciphers. A remote attacker can observe faulty ciphertext or supply encrypted input to disclose cleartext data and tamper with encrypted data.
The OpenSSL version and configuration determine which ciphers are disabled, and decryption may succeed even with the wrong key.
23) Integer overflow (CVE-ID: CVE-2026-14662)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in tsvector and tsquery data type functions when processing crafted large inputs. A remote user can supply crafted large inputs to cause an undersized allocation and write out-of-bounds to execute arbitrary code.
This may execute code as the operating system user running the database.
24) Integer overflow (CVE-ID: CVE-2026-6473)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to integer overflow in multiple PostgreSQL server features when processing application-supplied input. A remote user can provide crafted input to cause a denial of service.
The integer wraparound can undersize an allocation and lead to an out-of-bounds write that results in a segmentation fault.
25) Improper Authorization (CVE-ID: CVE-2026-6471)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in logical decoding when selecting a logical decoding plugin. A remote privileged user can choose an arbitrary file visible to the server operating system account as a logical decoding plugin to execute arbitrary code.
Exploitation requires the REPLICATION privilege but does not require superuser privileges.
26) Improper Authorization (CVE-ID: CVE-2026-6470)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to improper access control in PostgreSQL DDL commands when assigning a range subtype or referencing a type from an SQL expression. A remote user can create a dependency on the type to cause a denial of service.
The issue affects ALTER and DROP operations on the type.
27) Incorrect permission assignment for critical resource (CVE-ID: CVE-2026-6469)
CWE-ID: CWE-732 - Incorrect Permission Assignment for Critical Resource
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain unauthorized control over statistics objects.
The vulnerability exists due to improper ownership assignment in the ALTER TABLE ALTER TYPE command when altering a table column type. A remote privileged user can run ALTER TABLE ALTER TYPE to reassign ownership of dependent statistics objects and gain unauthorized control over statistics objects.
This can allow the table owner to run DROP STATISTICS and ALTER STATISTICS on affected dependent statistics objects, while denying those commands to the prior statistics object owner.
Remediation
Install update from vendor's website.