Critical Memory Disclosure Vulnerability in PostGIS Package
Summary
ALSA-2026:65899: Important: postgresql16-postgis security update. Affects postgis versions < 3.5.3-4.el10_2.1. Fixed in 3.5.3-4.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostGIS is an extension for the PostgreSQL object-relational database that adds support for geographic objects, enabling the database to function as a backend spatial database for Geographic Information Systems (GIS). It adheres to the OpenGIS Simple Features Specification for SQL and is recognized for its compliance with the Types and Functions profile. This functionality makes PostGIS a vital tool for applications that require spatial data processing and analysis. However, it is susceptible to vulnerabilities that can compromise data integrity and system availability.
Vulnerability Detail
The vulnerability identified as CVE-2026-73515 in PostGIS involves a memory disclosure and denial of service caused by a malformed FlatGeobuf buffer. This issue can lead to unauthorized access to sensitive data and potential service interruptions, affecting the overall reliability of applications that depend on PostGIS for spatial data management. The flaw arises from improper handling of input data, which can be exploited by attackers to manipulate the database's behavior.
How To Fix
Minimum fixed version
3.5.3-4.el10_2.1
This is the first release that contains the fix.
sudo dnf update postgisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the PostGIS service and monitor incoming requests for any suspicious activity until the package is updated. Additionally, disabling features that rely on FlatGeobuf processing may mitigate immediate risks.
Conclusion
The vulnerability CVE-2026-73515 in the PostGIS package poses significant risks, including memory disclosure and denial of service. It is crucial for users to update to the latest patched version to safeguard their systems. Implementing workarounds can provide temporary relief, but a complete fix through updates is essential for long-term security.
See every vulnerability recorded for postgis →
FAQ
CVE-2026-73515 is a vulnerability in the PostGIS package that allows for memory disclosure and denial of service due to malformed FlatGeobuf buffers.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized data access and service interruptions, which can severely affect applications relying on PostGIS for spatial data.
Yes, a patch is available in version 3.5.3-4.el10_2.1 of the PostGIS package. It is recommended to update to this version.
If immediate updates are not possible, consider implementing access restrictions and monitoring for unusual activity as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for postgis.
