Critical Security Update for PostgreSQL 18: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:19009: Important: postgresql18 security update. Affects postgresql18 versions < 18.3-1.el10_2. Fixed in 18.3-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced Object-Relational Database Management System (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide range of data types and offers powerful features such as transactions, sub-selects, triggers, views, and stored procedures. The impacted package, PostgreSQL 18, includes client programs necessary for accessing a PostgreSQL server, as well as documentation. This version has been found vulnerable to several security issues that could potentially allow unauthorized access or execution of arbitrary code.
Vulnerability Detail
The vulnerabilities in PostgreSQL 18 include a heap buffer overflow in pg_trgm that writes patterns onto server memory (CVE-2026-2007), an oidvector that discloses memory bytes (CVE-2026-2003), and a lack of validation for multibyte character lengths that can execute arbitrary code (CVE-2026-2006). Additionally, the intarray type's missing validation for input to the selectivity estimator can also lead to arbitrary code execution (CVE-2026-2004), and a heap buffer overflow in pgcrypto can execute arbitrary code (CVE-2026-2005). These vulnerabilities can lead to severe security breaches, including unauthorized data access and system compromise.
How To Fix
Minimum fixed version
18.3-1.el10_2
This is the first release that contains the fix.
sudo dnf update postgresql18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the PostgreSQL server by implementing firewall rules to limit connections to trusted IP addresses only. Additionally, review and restrict user permissions to minimize the risk of exploitation.
Conclusion
The vulnerabilities identified in PostgreSQL 18 pose significant security risks that need to be addressed promptly. By updating to the patched version and implementing recommended security practices, users can protect their systems from potential exploits. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for postgresql18 →
FAQ
The main vulnerabilities include heap buffer overflows, memory disclosure issues, and missing validation for input types, which can lead to arbitrary code execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Update to the latest patched version of PostgreSQL 18 and restrict access to the server using firewall rules and user permissions.
Yes, if exploited, these vulnerabilities could lead to unauthorized access and potential data loss or corruption.
Detailed information can be found on the CVE pages linked in the security advisory, as well as through the official PostgreSQL documentation.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18.
