CVE-2026-2005 PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
HighCVSS 8.8
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | < 0:16.13-1.el10_1 | 0:16.13-1.el10_1 |
| redhat enterprise linux | < 0:16.13-1.el10_2 | 0:16.13-1.el10_2 |
| redhat enterprise linux | < 0:18.3-1.el10_2 | 0:18.3-1.el10_2 |
| redhat enterprise linux eus | < 0:16.13-1.el10_0 | 0:16.13-1.el10_0 |
| redhat enterprise linux | < 8100020260227180702.489197e6 | 8100020260227180702.489197e6 |
| redhat enterprise linux | < 8100020260227221316.489197e6 | 8100020260227221316.489197e6 |
| redhat enterprise linux | < 8100020260227221401.489197e6 | 8100020260227221401.489197e6 |
| redhat enterprise linux | < 8100020260302082007.489197e6 | 8100020260302082007.489197e6 |
| redhat rhel aus | < 8020020260309120440.4cda2c84 | 8020020260309120440.4cda2c84 |
| redhat rhel aus | < 8040020260305144728.522a0ee4 | 8040020260305144728.522a0ee4 |
| redhat rhel aus | < 8040020260306101701.522a0ee4 | 8040020260306101701.522a0ee4 |
| redhat rhel eus long life | < 8040020260305144728.522a0ee4 | 8040020260305144728.522a0ee4 |
| redhat rhel eus long life | < 8040020260306101701.522a0ee4 | 8040020260306101701.522a0ee4 |
| redhat rhel aus | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel aus | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel tus | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel tus | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel e4s | < 8060020260306113941.ad008a3a | 8060020260306113941.ad008a3a |
| redhat rhel e4s | < 8060020260309111524.ad008a3a | 8060020260309111524.ad008a3a |
| redhat rhel tus | < 8080020260302123717.63b34585 | 8080020260302123717.63b34585 |
| redhat rhel tus | < 8080020260302123049.63b34585 | 8080020260302123049.63b34585 |
| redhat rhel e4s | < 8080020260302123717.63b34585 | 8080020260302123717.63b34585 |
| redhat rhel e4s | < 8080020260302123049.63b34585 | 8080020260302123049.63b34585 |
| redhat rhel e4s | < 8080020260306092921.63b34585 | 8080020260306092921.63b34585 |
| redhat enterprise linux | < 0:13.23-2.el9_7 | 0:13.23-2.el9_7 |
Show 119 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | < 9070020260227094950.rhel9 | 9070020260227094950.rhel9 |
| redhat enterprise linux | < 9070020260227095951.rhel9 | 9070020260227095951.rhel9 |
| redhat rhel e4s | < 0:13.23-1.el9_0.1 | 0:13.23-1.el9_0.1 |
| redhat rhel e4s | < 9020020260309133405.rhel9 | 9020020260309133405.rhel9 |
| redhat rhel e4s | < 0:13.23-1.el9_2.1 | 0:13.23-1.el9_2.1 |
| redhat rhel eus | < 0:13.23-1.el9_4.1 | 0:13.23-1.el9_4.1 |
| redhat rhel eus | < 9040020260306102041.rhel9 | 9040020260306102041.rhel9 |
| redhat rhel eus | < 9040020260305163703.rhel9 | 9040020260305163703.rhel9 |
| redhat rhel eus | < 0:13.23-1.el9_6.1 | 0:13.23-1.el9_6.1 |
| redhat rhel eus | < 9060020260309125703.rhel9 | 9060020260309125703.rhel9 |
| redhat rhel eus | < 9060020260305153549.rhel9 | 9060020260305153549.rhel9 |
| redhat hummingbird | < 18.3-1.2.hum1 | 18.3-1.2.hum1 |
| redhat rhui | < 1773670137 | 1773670137 |
| redhat enterprise linux | = 6 | No fix listed |
| redhat enterprise linux | = 7 | No fix listed |
| redhat enterprise linux | All versions | No fix listed |
| debian/postgresql-15(Debian:12) | < 15.16-0+deb12u1 | 15.16-0+deb12u1 |
| debian/postgresql-15(Debian:12) | = 15.10-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.11-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.12-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.12-0+deb12u2 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.13-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.14-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.15-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.3-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.3-1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-2 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.4-3 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.5-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.6-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.7-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.8-0+deb12u1 | No fix listed |
| debian/postgresql-15(Debian:12) | = 15.9-0+deb12u1 | No fix listed |
| debian/postgresql-17(Debian:13) | < 17.8-0+deb13u1 | 17.8-0+deb13u1 |
| debian/postgresql-17(Debian:13) | = 17.5-1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.6-0+deb13u1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.6-1 | No fix listed |
| debian/postgresql-17(Debian:13) | = 17.7-0+deb13u1 | No fix listed |
| debian/postgresql-18(Debian:14) | < 18.2-1 | 18.2-1 |
| debian/postgresql-18(Debian:14) | = 18.0-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18.1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18.1-2 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250612-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250624-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1+20250701-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta2-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~beta3-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-2 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~rc1-3 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250318+g4078da6c478-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250331-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250405-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250421-1 | No fix listed |
| debian/postgresql-18(Debian:14) | = 18~~devel.20250502-1 | No fix listed |
| ubuntu/postgresql-14(Ubuntu:22.04) | < 14.22-0ubuntu0.22.04.1 | 14.22-0ubuntu0.22.04.1 |
| redhat/postgresql16(Red Hat:enterprise_linux:10.1) | < 16.13-1.el10_1 | 16.13-1.el10_1 |
| redhat/postgresql18(Red Hat:enterprise_linux:10.2) | < 18.3-1.el10_2 | 18.3-1.el10_2 |
| redhat/postgresql16(Red Hat:enterprise_linux:10.2) | < 16.13-1.el10_2 | 16.13-1.el10_2 |
| redhat/postgresql16(Red Hat:enterprise_linux_eus:10.0) | < 16.13-1.el10_0 | 16.13-1.el10_0 |
| redhat/postgresql:13-8100020260227180702.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:15-8100020260227221316.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:16-8100020260227221401.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:12-8100020260302082007.489197e6(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/postgresql:12-8020020260309120440.4cda2c84(Red Hat:rhel_aus:8.2) | All versions | No fix listed |
| redhat/postgresql:13-8040020260305144728.522a0ee4(Red Hat:rhel_aus:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8040020260306101701.522a0ee4(Red Hat:rhel_aus:8.4) | All versions | No fix listed |
| redhat/postgresql:13-8040020260305144728.522a0ee4(Red Hat:rhel_eus_long_life:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8040020260306101701.522a0ee4(Red Hat:rhel_eus_long_life:8.4) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_aus:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_aus:8.6) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_tus:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_tus:8.6) | All versions | No fix listed |
| redhat/postgresql:12-8060020260306113941.ad008a3a(Red Hat:rhel_e4s:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8060020260309111524.ad008a3a(Red Hat:rhel_e4s:8.6) | All versions | No fix listed |
| redhat/postgresql:13-8080020260302123717.63b34585(Red Hat:rhel_tus:8.8) | All versions | No fix listed |
| redhat/postgresql:12-8080020260302123049.63b34585(Red Hat:rhel_tus:8.8) | All versions | No fix listed |
| redhat/postgresql:13-8080020260302123717.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql:12-8080020260302123049.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql:15-8080020260306092921.63b34585(Red Hat:rhel_e4s:8.8) | All versions | No fix listed |
| redhat/postgresql(Red Hat:enterprise_linux:9) | < 13.23-2.el9_7 | 13.23-2.el9_7 |
| redhat/postgresql:15-9070020260227094950.rhel9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/postgresql:16-9070020260227095951.rhel9(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_e4s:9.0) | < 13.23-1.el9_0.1 | 13.23-1.el9_0.1 |
| redhat/postgresql:15-9020020260309133405.rhel9(Red Hat:rhel_e4s:9.2) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_e4s:9.2) | < 13.23-1.el9_2.1 | 13.23-1.el9_2.1 |
| redhat/postgresql(Red Hat:rhel_eus:9.4) | < 13.23-1.el9_4.1 | 13.23-1.el9_4.1 |
| redhat/postgresql:16-9040020260306102041.rhel9(Red Hat:rhel_eus:9.4) | All versions | No fix listed |
| redhat/postgresql:15-9040020260305163703.rhel9(Red Hat:rhel_eus:9.4) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_eus:9.6) | < 13.23-1.el9_6.1 | 13.23-1.el9_6.1 |
| redhat/postgresql:15-9060020260309125703.rhel9(Red Hat:rhel_eus:9.6) | All versions | No fix listed |
| redhat/postgresql:16-9060020260305153549.rhel9(Red Hat:rhel_eus:9.6) | All versions | No fix listed |
| redhat/postgresql18-main(Red Hat:hummingbird:1) | < 18.3-1.2.hum1 | 18.3-1.2.hum1 |
| redhat/rhui5/rhua-rhel9:1773670137(Red Hat:rhui:5::el9) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_els:6) | All versions | No fix listed |
| redhat/postgresql(Red Hat:rhel_els:7) | All versions | No fix listed |
| redhat/postgresql:18/postgresql(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| alpine/postgresql15(Alpine:v3.20) | < 15.16-r0 | 15.16-r0 |
| alpine/postgresql15(Alpine:v3.22) | < 15.16-r0 | 15.16-r0 |
| alpine/postgresql16(Alpine:v3.20) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.21) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.22) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.23) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql16(Alpine:v3.24) | < 16.12-r0 | 16.12-r0 |
| alpine/postgresql17(Alpine:v3.21) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.22) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.23) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql17(Alpine:v3.24) | < 17.8-r0 | 17.8-r0 |
| alpine/postgresql18(Alpine:v3.23) | < 18.2-r0 | 18.2-r0 |
| alpine/postgresql18(Alpine:v3.24) | < 18.2-r0 | 18.2-r0 |
| ubuntu/postgresql-16(Ubuntu:24.04) | < 16.13-0ubuntu0.24.04.1 | 16.13-0ubuntu0.24.04.1 |
| postgresql | >= 14.0, < 14.21 | 14.21 |
| postgresql | >= 15.0, < 15.16 | 15.16 |
| postgresql | >= 16.0, < 16.12 | 16.12 |
| postgresql | >= 17.0, < 17.8 | 17.8 |
| postgresql | >= 18.0, < 18.2 | 18.2 |
References
- www.postgresql.org vendor-advisory
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2439326 issue-tracking
- security.access.redhat.com
- RHSA-2026:4441 patch vendor-advisory
- RHSA-2026:3887 patch vendor-advisory
- RHSA-2026:19010 patch vendor-advisory
- RHSA-2026:19009 patch vendor-advisory
- RHSA-2026:4064 patch vendor-advisory
- RHSA-2026:4024 patch vendor-advisory
- RHSA-2026:4059 patch vendor-advisory
- RHSA-2026:4063 patch vendor-advisory
- RHSA-2026:4506 patch vendor-advisory
- RHSA-2026:4509 patch vendor-advisory
- RHSA-2026:4504 patch vendor-advisory
- RHSA-2026:4505 patch vendor-advisory
- RHSA-2026:4516 patch vendor-advisory
- RHSA-2026:4075 patch vendor-advisory
- RHSA-2026:4074 patch vendor-advisory
- RHSA-2026:4515 patch vendor-advisory
- RHSA-2026:4518 patch vendor-advisory
- RHSA-2026:4254 patch vendor-advisory
- RHSA-2026:4475 patch vendor-advisory
- RHSA-2026:4548 patch vendor-advisory
- RHSA-2026:4544 patch vendor-advisory
- RHSA-2026:4524 patch vendor-advisory
- RHSA-2026:4546 patch vendor-advisory
- RHSA-2026:4547 patch vendor-advisory
- RHSA-2026:4528 patch vendor-advisory
- RHSA-2026:3896 patch vendor-advisory
- RHSA-2026:4110 patch vendor-advisory
- RHSA-2026:3730 patch vendor-advisory
- RHSA-2026:8756 patch vendor-advisory
- RHSA-2026:4943 patch vendor-advisory
- Debian Security Tracker CVE-2026-2005 vendor-advisory
- Ubuntu CVE tracker vendor-advisory
- USN-8072-1 vendor-advisory
- www.cve.org
- nvd.nist.gov
- security.alpinelinux.org vendor-advisory