Critical Memory Disclosure Vulnerability in postgresql18-postgis Package
Summary
ALSA-2026:67166: Important: postgresql18-postgis security update. Affects postgresql18-postgis versions < 3.5.3-1.el10_2.1. Fixed in 3.5.3-1.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostGIS is an extension for the PostgreSQL object-relational database that adds support for geographic objects. It enables PostgreSQL to function as a backend spatial database for geographic information systems (GIS). PostGIS adheres to the OpenGIS 'Simple Features Specification for SQL' and is certified compliant with the 'Types and Functions' profile. This functionality is crucial for applications that require spatial data processing and analysis.
Vulnerability Detail
The vulnerability identified as CVE-2026-73515 in the postgresql18-postgis package is a critical issue that allows for memory disclosure and potential denial of service through a malformed FlatGeobuf buffer. This vulnerability can be exploited by an attacker to access sensitive information stored in memory, which could lead to unauthorized data exposure and system instability. The flaw arises from improper handling of input data, making it essential for users to address this issue promptly.
How To Fix
Minimum fixed version
3.5.3-1.el10_2.1
This is the first release that contains the fix.
sudo dnf update postgresql18-postgisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit access to the PostgreSQL server to trusted IP addresses only, thereby reducing the risk of exploitation until the package is updated.
Conclusion
The postgresql18-postgis package has a critical vulnerability that requires immediate attention. Users should update to the latest patched version to mitigate risks associated with memory disclosure and denial of service. Implementing temporary workarounds can help reduce exposure until the update is applied.
See every vulnerability recorded for postgresql18-postgis →
FAQ
CVE-2026-73515 is a vulnerability in the postgresql18-postgis package that allows for memory disclosure and denial of service through malformed input.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized access to sensitive data and potential system crashes, impacting the integrity and availability of your database.
Yes, a patch is available in version 3.5.3-1.el10_2.1 of the postgresql18-postgis package.
If immediate updating is not possible, consider implementing access controls to limit exposure and monitor your systems for any suspicious activity.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18-postgis.
