Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Postgresql16 Security Update Fixes Multiple Risks
published 5 months ago
Summary
This update for Postgresql16 addresses several security risks, including potential SQL injection, buffer overruns, and unauthorized access. It also fixes non-security issues, such as improving system compatibility and configuration. We recommend installing the latest version to ensure your database is secure and stable.
Original advisory text
Security update for postgresql16
This update for postgresql16 fixes the following issues
Update to version 16.13.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
- CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14824).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
Update to version 16.13.
Security issues:
- CVE-2026-6472: ensure the user has CREATE privilege on the schema specified (bsc#1265172).
- CVE-2026-6473: integer overflows in memory-allocation calculations (bsc#1265173).
- CVE-2026-6474: Guard against malicious time zone names (bsc#1265174).
- CVE-2026-6475: Prevent path traversal in pg_basebackup and pg_rewind (bsc#1265175).
- CVE-2026-6477: Mark PQfn() as unsafe, and avoid using it within libpq (bsc#1265177).
- CVE-2026-6478: Use timing-safe string comparisons in authentication code (bsc#1265178).
- CVE-2026-6479: Prevent unbounded recursion while processing startup packets (bsc#1265179).
- CVE-2026-6637: Prevent SQL injection and buffer overruns in contrib/spi (bsc#1265181).
- CVE-2026-6638: Properly quote object names in logical replication origin checks (bsc#1265182).
Non security issue:
- Get rid of update-alternatives for openSUSE/SLE 16.0 and newer to support immutable systems and transactional
updates (jsc#PED-14824).
- /usr/bin/pg_config is missing after migrating away from update-alternatives (bsc#1263804).
References
- https://www.suse.com/support/update/announcement/2026/suse-su-20261942-1/ Vendor Advisory
- https://bugzilla.suse.com/1263804 Third Party Advisory
- https://bugzilla.suse.com/1265172 Third Party Advisory
- https://bugzilla.suse.com/1265173 Third Party Advisory
- https://bugzilla.suse.com/1265174 Third Party Advisory
- https://bugzilla.suse.com/1265175 Third Party Advisory
- https://bugzilla.suse.com/1265177 Third Party Advisory
- https://bugzilla.suse.com/1265178 Third Party Advisory
- https://bugzilla.suse.com/1265179 Third Party Advisory
- https://bugzilla.suse.com/1265181 Third Party Advisory
- https://bugzilla.suse.com/1265182 Third Party Advisory
- https://www.suse.com/security/cve/CVE-2026-6472 URL
- https://www.suse.com/security/cve/CVE-2026-6473 URL
- https://www.suse.com/security/cve/CVE-2026-6474 URL
- https://www.suse.com/security/cve/CVE-2026-6475 URL
- https://www.suse.com/security/cve/CVE-2026-6477 URL
- https://www.suse.com/security/cve/CVE-2026-6478 URL
- https://www.suse.com/security/cve/CVE-2026-6479 URL
- https://www.suse.com/security/cve/CVE-2026-6637 URL
- https://www.suse.com/security/cve/CVE-2026-6638 URL
Timeline
Published18 May 2026
Updated19 May 2026
First seen19 May 2026
Sources
SUSE-SU-2026:1942-1 · OSV
Track software like this
Free during beta