PostgreSQL Format String Vulnerability in Timeofday Function - CVE-2026-6474
Summary
ALPINE-CVE-2026-6474: Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Affects postgresql17 versions < 17.10-r0. Fixed in 17.10-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database management system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The timeofday() function in PostgreSQL retrieves the current date and time, but it has been found to be vulnerable to an externally-controlled format string issue, which can lead to unauthorized access to server memory.
Vulnerability Detail
The vulnerability arises from an externally-controlled format string in the timeofday() function, which allows attackers to craft malicious timezone zones. By exploiting this vulnerability, an attacker can potentially retrieve sensitive portions of the server's memory, leading to data leakage and unauthorized access. This issue affects versions of PostgreSQL prior to 18.4, 17.10, 16.14, 15.18, and 14.23.
How To Fix
Minimum fixed version
17.10-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the PostgreSQL server to trusted networks only, and monitor for any unusual activity that may indicate exploitation attempts.
Conclusion
CVE-2026-6474 is a significant vulnerability affecting PostgreSQL's timeofday() function, which can lead to unauthorized memory access. It is crucial to update to the latest versions to protect against potential exploitation. Regular monitoring and using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for postgresql17 →
FAQ
CVE-2026-6474 is a vulnerability in PostgreSQL's timeofday() function that allows attackers to exploit format strings to access server memory.
Versions prior to PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data in server memory, potentially compromising the integrity and confidentiality of the database.
The CVSS score for CVE-2026-6474 is 4.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql17.
