Most recent entries from all

bdu:2026-11958

BELL-CVE-2026-14672

Affected: Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18

BIT-postgresql-2026-14672 — PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Affected: Bitnami: postgresql

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

certfr-2026-avi-1024 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p…

certfr-2026-avi-1024

EUVD-2026-361649

fkie_cve-2026-14672

GHSA-hp2m-55fj-8mw5

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.

msrc_CVE-2026-14672 — PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

msrc_CVE-2026-14672

OESA-2026-3423 — postgresql-17 security update

Affected: openEuler:24.03-LTS-SP4: postgresql-17

PostgreSQL client programs Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14663)

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system use…

openSUSE-SU-2026:11554-1 — postgresql16-16.15-1.1 on GA media

postgresql16-16.15-1.1 on GA media

SUSE-SU-2026:23577-1 — Security update for postgresql18

Security update for postgresql18

UBUNTU-CVE-2026-14672

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18

WID-SEC-W-2026-2844 — PostgreSQL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.