SB2026081735 - Gentoo update for PostgreSQL
Published: August 17, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 22 vulnerabilities.
1) Missing Authorization (CVE-ID: CVE-2026-6472)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL functions in victim queries.
The vulnerability exists due to improper access control in the CREATE TYPE command when creating a multirange type without checking schema CREATE privilege. A remote user can create a crafted type to execute arbitrary SQL functions in victim queries.
The issue can hijack queries that use search_path to find user-defined types, including extension-defined types.
2) SQL injection (CVE-ID: CVE-2026-6638)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL with the subscription's publication-side credentials.
The vulnerability exists due to SQL injection in ALTER SUBSCRIPTION ... REFRESH PUBLICATION when processing a table name. A remote user can create a crafted subscriber table name to execute arbitrary SQL with the subscription's publication-side credentials.
User interaction is required for the next REFRESH PUBLICATION to occur.
3) Stack-based buffer overflow (CVE-ID: CVE-2026-6637)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code as the operating system user running the database.
The vulnerability exists due to a stack-based buffer overflow in the refint module when processing crafted input. A remote user can supply crafted input to execute arbitrary code as the operating system user running the database.
4) Out-of-bounds read (CVE-ID: CVE-2026-6575)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the pg_restore_attribute_stats() function when accepting array values of unmatched length. A remote user can supply crafted array values to disclose sensitive information.
The issue allows a table maintainer to infer memory values past the end of one stats array.
5) Uncontrolled Recursion (CVE-ID: CVE-2026-6479)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in SSL and GSS negotiation when initializing connections. A remote attacker can connect to a vulnerable socket to cause a denial of service.
If SSL and GSS are both disabled, exploitation is possible via access to a PostgreSQL TCP socket. Otherwise, the attacker must be able to connect to a PostgreSQL AF_UNIX socket.
6) Information Exposure Through Timing Discrepancy (CVE-ID: CVE-2026-6478)
CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to recover credentials sufficient to authenticate.
The vulnerability exists due to observable timing discrepancies in MD5-hashed password comparison during authentication. A remote attacker can measure authentication timing to recover credentials sufficient to authenticate.
The issue does not affect scram-sha-256 passwords and applies to MD5-hashed passwords that may originate from upgrades from PostgreSQL 13 or earlier.
7) Stack-based buffer overflow (CVE-ID: CVE-2026-6477)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite client stack memory.
The vulnerability exists due to a stack-based buffer overflow in libpq lo_* functions when processing an arbitrarily large server response through PQfn(..., result_is_int=0, ...). A remote attacker can induce a victim client to process a crafted server response to overwrite client stack memory.
User interaction is required to invoke affected client functionality such as psql \lo_export or pg_dump. The issue affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64().
8) SQL injection (CVE-ID: CVE-2026-6476)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary SQL as a superuser.
The vulnerability exists due to SQL injection in pg_createsubscriber when processing a subscription name. A remote privileged user can supply a crafted subscription name to execute arbitrary SQL as a superuser.
The attack takes effect when pg_createsubscriber next runs.
9) Link following (CVE-ID: CVE-2026-6475)
CWE-ID: CWE-59 - Improper Link Resolution Before File Access ('Link Following')
CVSSv4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite arbitrary local files.
The vulnerability exists due to symlink following in pg_basebackup plain format and pg_rewind when processing files from an origin server. A remote attacker can provide crafted symlinks to overwrite arbitrary local files.
User interaction is required to run pg_basebackup or pg_rewind. The attack has practical implications only if relevant action is taken before the server is started, such as moving files to a different VM or snapshotting the VM.
10) Format string error (CVE-ID: CVE-2026-6474)
CWE-ID: CWE-134 - Use of Externally-Controlled Format String
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to an externally-controlled format string in the timeofday() function when processing crafted timezone zones. A remote user can supply a crafted timezone zone to disclose sensitive information.
The issue can expose portions of server memory.
11) Integer overflow (CVE-ID: CVE-2026-6473)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to integer overflow in multiple PostgreSQL server features when processing application-supplied input. A remote user can provide crafted input to cause a denial of service.
The integer wraparound can undersize an allocation and lead to an out-of-bounds write that results in a segmentation fault.
12) Input validation error (CVE-ID: CVE-2025-1094) Exploited
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary SQL queries in the database.
The vulnerability exists due to insufficient validation of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() and within the command line utility programs when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. A remote attacker can pass specially crafted input to the application and execute arbitrary SQL queries in the database.
Note, the vulnerability is being actively exploited in the wild.
13) Heap-based buffer overflow (CVE-ID: CVE-2026-2007)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in pg_trgm. A remote user can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
14) Buffer overflow (CVE-ID: CVE-2026-2006)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to missing validation of multibyte character length. A remote user can send a specially crafted query to the application, trigger memory corruption and execute arbitrary code on the target system.
15) Heap-based buffer overflow (CVE-ID: CVE-2026-2005)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in pgcrypto. A remote user can pass specially crafted data to the application, trigger a heap-based buffer overflow and execute arbitrary code on the target system.
16) Type confusion (CVE-ID: CVE-2026-2004)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to a type confusion error in intarray extension. A remote user can pass specially crafted data to the application, trigger a type confusion error and execute arbitrary code on the target system.
17) Out-of-bounds read (CVE-ID: CVE-2026-2003)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain access to potentially sensitive information.
The vulnerability exists due to a boundary condition when handling oidvector data type. A remote user can trigger an out-of-bounds read error and read contents of memory on the system.
18) Missing authorization (CVE-ID: CVE-2025-12817)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to perform a denial of service attack.
The vulnerability exists due to missing authorization in the CREATE STATISTICS command. A remote user can perform denial of service against other CREATE STATISTICS users by creating in any schema.
19) Input validation error (CVE-ID: CVE-2025-8715)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary psql code.
The vulnerability exists in pg_dump due to insufficient validation of user-supplied input when handling new line characters. A remote attacker can trick the victim into loading a specially crafted backup and execute arbitrary psql code on the system.
20) Code Injection (CVE-ID: CVE-2025-8714)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary psql code on the target system.
The vulnerability exists due to improper input validation in pg_dump. A malicious superuser of the origin server to inject arbitrary psql code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands, such as pg_dump, pg_dumpall, and pg_restore.
21) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2025-8713)
CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. A remote user can gain access to sensitive information.
22) Buffer Over-read (CVE-ID: CVE-2025-4207)
CWE-ID: CWE-126 - Buffer over-read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a buffer over-read in GB18030 encoding validation. A remote attacker can pass specially crafted input to the application, trigger a one-byte buffer over-read and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.