CVE-2026-2004 PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
HighCVSS 8.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | < 0:16.13-1.el10_1 | 0:16.13-1.el10_1 |
| redhat enterprise linux | < 0:16.13-1.el10_2 | 0:16.13-1.el10_2 |
| redhat enterprise linux | < 0:18.3-1.el10_2 | 0:18.3-1.el10_2 |
| redhat enterprise linux eus | < 0:16.13-1.el10_0 | 0:16.13-1.el10_0 |
| redhat enterprise linux | < 8100020260227180702.489197e6 | 8100020260227180702.489197e6 |
| redhat enterprise linux | < 8100020260227221316.489197e6 | 8100020260227221316.489197e6 |
| redhat enterprise linux | < 8100020260227221401.489197e6 | 8100020260227221401.489197e6 |
| redhat enterprise linux | < 8100020260302082007.489197e6 | 8100020260302082007.489197e6 |
| redhat rhel aus | < 8020020260309120440.4cda2c84 | 8020020260309120440.4cda2c84 |
| redhat rhel aus | < 8040020260305144728.522a0ee4 | 8040020260305144728.522a0ee4 |
| redhat rhel aus | < 8040020260306101701.522a0ee4 | 8040020260306101701.522a0ee4 |
| redhat rhel eus long life | < 8040020260305144728.522a0ee4 | 8040020260305144728.522a0ee4 |
| redhat rhel eus long life | < 8040020260306101701.522a0ee4 | 8040020260306101701.522a0ee4 |
| redhat rhel aus | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel aus | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel tus | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel tus | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel e4s | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel e4s | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel tus | < 8080020260302123717.63b34585 | 8080020260302123717.63b34585 |
| redhat rhel tus | < 8080020260302123049.63b34585 | 8080020260302123049.63b34585 |
| redhat rhel e4s | < 8080020260302123717.63b34585 | 8080020260302123717.63b34585 |
| redhat rhel e4s | < 8080020260302123049.63b34585 | 8080020260302123049.63b34585 |
| redhat rhel e4s | < 8080020260306092921.63b34585 | 8080020260306092921.63b34585 |
| redhat enterprise linux | < 0:13.23-2.el9_7 | 0:13.23-2.el9_7 |
Show 119 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | < 9070020260227094950.rhel9 | 9070020260227094950.rhel9 |
| redhat enterprise linux | < 9070020260227095951.rhel9 | 9070020260227095951.rhel9 |
| redhat rhel e4s | < 0:13.23-1.el9_0.1 | 0:13.23-1.el9_0.1 |
| redhat rhel e4s | < 9020020260309133405.rhel9 | 9020020260309133405.rhel9 |
| redhat rhel e4s | < 0:13.23-1.el9_2.1 | 0:13.23-1.el9_2.1 |
| redhat rhel eus | < 0:13.23-1.el9_4.1 | 0:13.23-1.el9_4.1 |
| redhat rhel eus | < 9040020260306102041.rhel9 | 9040020260306102041.rhel9 |
| redhat rhel eus | < 9040020260305163703.rhel9 | 9040020260305163703.rhel9 |
| redhat rhel eus | < 0:13.23-1.el9_6.1 | 0:13.23-1.el9_6.1 |
| redhat rhel eus | < 9060020260309125703.rhel9 | 9060020260309125703.rhel9 |
| redhat rhel eus | < 9060020260305153549.rhel9 | 9060020260305153549.rhel9 |
| redhat hummingbird | < 18.3-1.2.hum1 | 18.3-1.2.hum1 |
| redhat rhui | < 1773670137 | 1773670137 |
| redhat enterprise linux | = 6 | No fix listed |
| redhat enterprise linux | = 7 | No fix listed |
| redhat enterprise linux | All versions | No fix listed |
| debian/postgresql-15(Debian:12) | < 15.16-0+deb12u1 | 15.16-0+deb12u1 |
| debian/postgresql-15(Debian:12) | = 15.10-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.11-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.12-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.12-0+deb12u2 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.13-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.14-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.15-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.3-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.3-1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-2 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-3 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.5-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.6-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.7-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.8-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.9-0+deb12u1 | No fix listed |
| debian/postgresql-17(Debian:13) | < 17.8-0+deb13u1 | 17.8-0+deb13u1 |
| debian/postgresql-17(Debian:13) | = 17.5-1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.6-0+deb13u1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.6-1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.7-0+deb13u1 | No fix listed |
| debian/postgresql-18(Debian:14) | < 18.2-1 | 18.2-1 |
| debian/postgresql-18(Debian:14) | = 18.0-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18.1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18.1-2 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250612-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250624-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250701-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta2-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta3-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-2 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-3 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250318+g4078da6c478-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250331-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250405-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250421-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250502-1 | No fix listed |
| ubuntu/postgresql-14(Ubuntu:22.04) | < 14.22-0ubuntu0.22.04.1 | 14.22-0ubuntu0.22.04.1 |
| redhat/postgresql16(Red Hat:enterprise_linux:10.1) | < 16.13-1.el10_1 | 16.13-1.el10_1 |
| redhat/postgresql18(Red Hat:enterprise_linux:10.2) | < 18.3-1.el10_2 | 18.3-1.el10_2 |
| redhat/postgresql16(Red Hat:enterprise_linux:10.2) | < 16.13-1.el10_2 | 16.13-1.el10_2 |
| redhat/postgresql16(Red Hat:enterprise_linux_eus:10.0) | < 16.13-1.el10_0 | 16.13-1.el10_0 |
| redhat/postgresql:13-8100020260227180702.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:15-8100020260227221316.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:16-8100020260227221401.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:12-8100020260302082007.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:12-8020020260309120440.4cda2c84(Red Hat:rhel_aus:8.2) | All versions | No fix listed |
| redhat/postgresql:13-8040020260305144728.522a0ee4(Red Hat:rhel_aus:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8040020260306101701.522a0ee4(Red Hat:rhel_aus:8.4) | All versions | No fix listed |
| redhat/postgresql:13-8040020260305144728.522a0ee4(Red Hat:rhel_eus_long_life:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8040020260306101701.522a0ee4(Red Hat:rhel_eus_long_life:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_aus:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_aus:8.6) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_tus:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_tus:8.6) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_e4s:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_e4s:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8080020260302123717.63b34585(Red Hat:rhel_tus:8.8) | All versions | No fix listed |
| redhat/postgresql:12-8080020260302123049.63b34585(Red Hat:rhel_tus:8.8) | All versions | No fix listed |
| redhat/postgresql:13-8080020260302123717.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql:12-8080020260302123049.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql:15-8080020260306092921.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql(Red Hat:enterprise_linux:9) | < 13.23-2.el9_7 | 13.23-2.el9_7 |
| redhat/postgresql:15-9070020260227094950.rhel9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/postgresql:16-9070020260227095951.rhel9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_e4s:9.0) | < 13.23-1.el9_0.1 | 13.23-1.el9_0.1 |
| redhat/postgresql:15-9020020260309133405.rhel9(Red Hat:rhel_e4s:9.2) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_e4s:9.2) | < 13.23-1.el9_2.1 | 13.23-1.el9_2.1 |
| redhat/postgresql(Red Hat:rhel_eus:9.4) | < 13.23-1.el9_4.1 | 13.23-1.el9_4.1 |
| redhat/postgresql:16-9040020260306102041.rhel9(Red Hat:rhel_eus:9.4) | All versions | No fix listed |
| redhat/postgresql:15-9040020260305163703.rhel9(Red Hat:rhel_eus:9.4) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_eus:9.6) | < 13.23-1.el9_6.1 | 13.23-1.el9_6.1 |
| redhat/postgresql:15-9060020260309125703.rhel9(Red Hat:rhel_eus:9.6) | All versions | No fix listed |
| redhat/postgresql:16-9060020260305153549.rhel9(Red Hat:rhel_eus:9.6) | All versions | No fix listed |
| redhat/postgresql18-main(Red Hat:hummingbird:1) | < 18.3-1.2.hum1 | 18.3-1.2.hum1 |
| redhat/rhui5/rhua-rhel9:1773670137(Red Hat:rhui:5::el9) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/postgresql:18/postgresql(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| alpine/postgresql15(Alpine:v3.20) | < 15.16-r0 | 15.16-r0 |
| alpine/postgresql15(Alpine:v3.22) | < 15.16-r0 | 15.16-r0 |
| alpine/postgresql16(Alpine:v3.20) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.21) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.22) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.23) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.24) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql17(Alpine:v3.21) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.22) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.23) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.24) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql18(Alpine:v3.23) | < 18.2-r0 | 18.2-r0 |
| alpine/postgresql18(Alpine:v3.24) | < 18.2-r0 | 18.2-r0 |
| ubuntu/postgresql-16(Ubuntu:24.04) | < 16.13-0ubuntu0.24.04.1 | 16.13-0ubuntu0.24.04.1 |
| postgresql | >= 14.0, < 14.21 | 14.21 |
| postgresql | >= 15.0, < 15.16 | 15.16 |
| postgresql | >= 16.0, < 16.12 | 16.12 |
| postgresql | >= 17.0, < 17.8 | 17.8 |
| postgresql | >= 18.0, < 18.2 | 18.2 |
References
- www.postgresql.org vendor-advisory
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2439325 issue-tracking
- security.access.redhat.com
- RHSA-2026:4441 patch vendor-advisory
- RHSA-2026:3887 patch vendor-advisory
- RHSA-2026:19010 patch vendor-advisory
- RHSA-2026:19009 patch vendor-advisory
- RHSA-2026:4064 patch vendor-advisory
- RHSA-2026:4024 patch vendor-advisory
- RHSA-2026:4059 patch vendor-advisory
- RHSA-2026:4063 patch vendor-advisory
- RHSA-2026:4506 patch vendor-advisory
- RHSA-2026:4509 patch vendor-advisory
- RHSA-2026:4504 patch vendor-advisory
- RHSA-2026:4505 patch vendor-advisory
- RHSA-2026:4516 patch vendor-advisory
- RHSA-2026:4075 patch vendor-advisory
- RHSA-2026:4074 patch vendor-advisory
- RHSA-2026:4515 patch vendor-advisory
- RHSA-2026:4518 patch vendor-advisory
- RHSA-2026:4254 patch vendor-advisory
- RHSA-2026:4475 patch vendor-advisory
- RHSA-2026:4548 patch vendor-advisory
- RHSA-2026:4544 patch vendor-advisory
- RHSA-2026:4524 patch vendor-advisory
- RHSA-2026:4546 patch vendor-advisory
- RHSA-2026:4547 patch vendor-advisory
- RHSA-2026:4528 patch vendor-advisory
- RHSA-2026:3896 patch vendor-advisory
- RHSA-2026:4110 patch vendor-advisory
- RHSA-2026:3730 patch vendor-advisory
- RHSA-2026:8756 patch vendor-advisory
- RHSA-2026:4943 patch vendor-advisory
- Debian Security Tracker CVE-2026-2004 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8072-1 vendor-advisory
- www.cve.org
- nvd.nist.gov
- security.alpinelinux.org vendor-advisory