Critical Security Update for PostgreSQL: Addressing Code Execution Vulnerabilities
Summary
ALSA-2026:72274: Important: postgresql:12 security update. Affects pg_repack versions < 1.4.6-3.module_el8.9.0+3704+f1f917ce. Fixed in 1.4.6-3.module_el8.9.0+3704+f1f917ce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports advanced data types and offers features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code, particularly during restore operations and through untrusted data inclusion in pg_dump.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL (CVE-2025-8714 and CVE-2026-18408) stem from flaws in the code execution process during restore operations and the handling of untrusted data in pg_dump. These vulnerabilities could allow an attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data manipulation, or system compromise. The risks associated with these vulnerabilities are significant, as they can affect the integrity and confidentiality of the database.
How To Fix
Minimum fixed version
1.4.6-3.module_el8.9.0+3704+f1f917ce
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit access to the database and avoid using pg_dump with untrusted data until the update is applied. Additionally, consider reviewing and sanitizing any data that will be included in pg_dump operations.
Conclusion
The recent vulnerabilities in PostgreSQL highlight the importance of maintaining up-to-date software to protect against potential security threats. By applying the necessary updates and following best practices, users can safeguard their databases from exploitation.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-8714 refers to a vulnerability in PostgreSQL that allows code execution during restore operations.
CVE-2026-18408 is a vulnerability that permits arbitrary code execution via untrusted data inclusion in pg_dump.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, limit database access and avoid using pg_dump with untrusted data as a temporary workaround.
More details about the vulnerabilities can be found on the respective CVE pages for CVE-2025-8714 and CVE-2026-18408.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
