Critical Memory Disclosure and Denial of Service in postgresql18-postgis - CVE-2026-73515
Summary
RLSA-2026:67166: Important: postgresql18-postgis security update. Affects postgresql18-postgis versions < 0:3.5.3-1.el10_2.1. Fixed in 0:3.5.3-1.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostGIS is an extension for the PostgreSQL object-relational database that adds support for geographic objects. It enables PostgreSQL to function as a spatial database for geographic information systems (GIS), adhering to the OpenGIS Simple Features Specification for SQL. This functionality is crucial for applications that require spatial data handling, making PostGIS a widely used tool in various industries. However, it is susceptible to vulnerabilities that can compromise its integrity and availability.
Vulnerability Detail
The vulnerability identified as CVE-2026-73515 in postgresql18-postgis involves a memory disclosure and denial of service caused by a malformed FlatGeobuf buffer. This issue can lead to unauthorized access to sensitive data stored in memory and can disrupt the service, making it unavailable to users. The potential ramifications include data leaks and service interruptions, which can severely impact applications relying on PostGIS for spatial data processing.
How To Fix
Minimum fixed version
0:3.5.3-1.el10_2.1
This is the first release that contains the fix.
sudo dnf update postgresql18-postgisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if immediate updating is not feasible, consider restricting access to the affected services or disabling features that utilize the vulnerable components until the update can be applied. This can help mitigate the risk of exploitation.
Conclusion
The postgresql18-postgis package has a critical vulnerability (CVE-2026-73515) that can lead to memory disclosure and denial of service. It is crucial to update to the patched version to ensure the security and availability of your applications. Utilize tools like Vulert to monitor and assess your software for vulnerabilities effectively.
See every vulnerability recorded for postgresql18-postgis →
FAQ
CVE-2026-73515 is a security vulnerability in postgresql18-postgis that allows for memory disclosure and denial of service due to malformed FlatGeobuf buffers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include potential unauthorized access to sensitive data and service disruptions, which can affect applications relying on PostGIS.
You can update the package by running 'sudo yum update postgresql18-postgis' in your terminal to install the patched version.
Yes, you can restrict access to the affected services or disable features that use the vulnerable components until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18-postgis.
