Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

PostgreSQL 15 lets attackers execute code

published 1 month ago
Summary

The PostgreSQL 15 database and extensions used by rocky/pgaudit, rocky/pg_repack, and rocky/postgres-decoderbufs contain several flaws that could let a malicious user run their own programs on the server. This can lead to data theft, corruption, or further compromise of your network. Apply the latest PostgreSQL 15 security updates as soon as possible to close these gaps.

What to do
  • Update rocky pgaudit to version 0:1.7.0-1.module+el9.7.0+40011+28af63c9.
  • Update rocky pg_repack to version 0:1.4.8-2.module+el9.7.0+40011+28af63c9.
  • Update rocky postgres-decoderbufs to version 0:1.9.7-1.Final.module+el9.7.0+40011+28af63c9.
Affected software
Ecosystem VendorProductAffected versions
Rocky Linux:9 rocky pgaudit < 0:1.7.0-1.module+el9.7.0+40011+28af63c9
Fix: upgrade to 0:1.7.0-1.module+el9.7.0+40011+28af63c9
Rocky Linux:9 rocky pg_repack < 0:1.4.8-2.module+el9.7.0+40011+28af63c9
Fix: upgrade to 0:1.4.8-2.module+el9.7.0+40011+28af63c9
Rocky Linux:9 rocky postgres-decoderbufs < 0:1.9.7-1.Final.module+el9.7.0+40011+28af63c9
Fix: upgrade to 0:1.9.7-1.Final.module+el9.7.0+40011+28af63c9
Original advisory text
Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)

* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)

* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)

* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

* postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)

* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)

* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)

* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)

* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)

* postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)

* postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)

* postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)

* postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)

* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)

* postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Timeline
Published22 Sep 2026
Updated22 Sep 2026
First seen22 Sep 2026
Sources
RLSA-2026:69914 · OSV
Track software like this
Free during beta