Buffer Over-read Vulnerability in PostgreSQL 18.3 and Earlier Versions
Summary
ALPINE-CVE-2026-6575: Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. Affects postgresql18 versions < 18.4-r0. Fixed in 18.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system known for its reliability, feature robustness, and performance. It supports a wide range of data types and offers advanced features such as transactions, concurrency, and complex queries. However, versions of PostgreSQL prior to 18.4 are susceptible to a buffer over-read vulnerability that can expose sensitive memory data.
Vulnerability Detail
The vulnerability arises from the pg_restore_attribute_stats() function, which accepts array values of unmatched lengths. This flaw allows the query planner to read beyond the end of the array, potentially revealing sensitive memory values. This could enable a table maintainer to infer information that should remain confidential, posing a significant risk to data integrity and security.
How To Fix
Minimum fixed version
18.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting access to the affected PostgreSQL functions or implementing strict input validation to prevent unmatched array lengths until the update can be applied.
Conclusion
In summary, the buffer over-read vulnerability in PostgreSQL versions 18.3 and earlier poses a risk to data integrity by allowing unauthorized memory access. It is crucial to update to version 18.4 or later to mitigate this issue. Additionally, utilizing tools like Vulert can help monitor for such vulnerabilities in your applications.
See every vulnerability recorded for postgresql18 →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate severity level.
PostgreSQL versions 18.3 and earlier are affected by this vulnerability. Versions 18.4 and later are not.
Exploitation of this vulnerability could lead to unauthorized access to sensitive memory data, compromising the confidentiality of the database.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json, providing real-time insights into potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18.
