Critical Vulnerability in PostgreSQL Packages: Code Execution Risks
Summary
ALSA-2025:14826: Important: postgresql16 security update. Affects postgresql versions < 16.10-1.el10_0. Fixed in 16.10-1.el10_0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced Object-Relational database management system (DBMS) that provides a robust platform for managing data. It includes client programs for accessing PostgreSQL servers, as well as comprehensive documentation. The affected packages include postgresql, postgresql-contrib, postgresql-docs, and others, all of which are essential for database operations. The vulnerability poses significant risks, allowing unauthorized code execution during restore operations.
Vulnerability Detail
The vulnerability stems from flaws in the PostgreSQL restore operation, identified as CVE-2025-8714 and CVE-2025-8715. These vulnerabilities enable attackers to execute arbitrary code on the server, potentially compromising the entire database system. The risks associated with these vulnerabilities include unauthorized access, data manipulation, and system instability, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
16.10-1.el10_0
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the PostgreSQL server and disabling restore operations until the packages are updated. This can help mitigate the risk of exploitation during the vulnerability window.
Conclusion
The PostgreSQL packages are currently vulnerable to critical security issues that allow for arbitrary code execution. It is imperative for users to update their installations to the latest patched version to safeguard their systems. Implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for postgresql →
FAQ
The vulnerabilities allow for arbitrary code execution during the restore operation, posing serious security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerabilities are identified as CVE-2025-8714 and CVE-2025-8715.
Consider implementing access restrictions and disabling restore operations as a temporary workaround.
Detailed information can be found in the advisories linked in the vulnerability report, including the CVE pages.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
