Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-14T13:00:12 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory 8.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H CWE-120

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.

This IMPORTANT buffer overflow in PostgreSQL libpq allows a malicious server superuser to overwrite client stack memory via lo_* functions. Exploitation requires the victim to connect to a compromised or malicious server (UI:R). The scope is changed as the server attack affects the client system. Impact is high to confidentiality, integrity, and availability through potential client-side code execution. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23. Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers. Red Hat Enterprise Linux 10 2026-06-22T00:00:00Z RHSA-2026:27742 postgresql18-0:18.4-1.el10_2 Red Hat Enterprise Linux 10 2026-06-22T00:00:00Z RHSA-2026:27743 postgresql16-0:16.14-1.el10_2 Red Hat Enterprise Linux 10 2026-07-23T00:00:00Z RHSA-2026:44391 libpq-0:16.14-1.el10_2 Red Hat Enterprise Linux 10.0 Extended Update Support 2026-06-22T00:00:00Z RHSA-2026:27718 postgresql16-0:16.14-1.el10_0 Red Hat Enterprise Linux 8 2026-06-16T00:00:00Z RHSA-2026:26181 postgresql:15-8100020260605152259.489197e6 Red Hat Enterprise Linux 8 2026-06-22T00:00:00Z RHSA-2026:27738 libpq-0:13.23-2.el8_10 Red Hat Enterprise Linux 8 2026-06-23T00:00:00Z RHSA-2026:28143 postgresql:16-8100020260530205218.489197e6 Red Hat Enterprise Linux 8 2026-06-23T00:00:00Z RHSA-2026:28208 postgresql:13-8100020260605152256.489197e6 Red Hat Enterprise Linux 8 2026-06-24T00:00:00Z RHSA-2026:28999 postgresql:12-8100020260605152253.489197e6 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-01T00:00:00Z RHSA-2026:34362 postgresql:12-8040020260624104459.522a0ee4 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-01T00:00:00Z RHSA-2026:34363 postgresql:13-8040020260630100922.522a0ee4 Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 2026-07-23T00:00:00Z RHSA-2026:44420 libpq-0:13.23-1.el8_4.1 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-01T00:00:00Z RHSA-2026:34362 postgresql:12-8040020260624104459.522a0ee4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-01T00:00:00Z RHSA-2026:34363 postgresql:13-8040020260630100922.522a0ee4 Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 2026-07-23T00:00:00Z RHSA-2026:44420 libpq-0:13.23-1.el8_4.1 Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-06-25T00:00:00Z RHSA-2026:29815 postgresql:12-8060020260623094704.ad008a3a Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 2026-06-29T00:00:00Z RHSA-2026:32994 postgresql:13-8060020260625065744.ad008a3a Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-06-25T00:00:00Z RHSA-2026:29815 postgresql:12-8060020260623094704.ad008a3a Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 2026-06-29T00:00:00Z RHSA-2026:32994 postgresql:13-8060020260625065744.ad008a3a Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-06-17T00:00:00Z RHSA-2026:26561 postgresql:15-8080020260615085052.63b34585 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-01T00:00:00Z RHSA-2026:34043 postgresql:12-8080020260626093604.63b34585 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-06T00:00:00Z RHSA-2026:35880 libpq-0:13.23-1.el8_8.1 Red Hat Enterprise Linux 8.8 Telecommunications Update Service 2026-07-21T00:00:00Z RHSA-2026:42555 postgresql:13-8080020260709122729.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-06-17T00:00:00Z RHSA-2026:26561 postgresql:15-8080020260615085052.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-01T00:00:00Z RHSA-2026:34043 postgresql:12-8080020260626093604.63b34585 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-06T00:00:00Z RHSA-2026:35880 libpq-0:13.23-1.el8_8.1 Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 2026-07-21T00:00:00Z RHSA-2026:42555 postgresql:13-8080020260709122729.63b34585 Red Hat Enterprise Linux 9 2026-06-16T00:00:00Z RHSA-2026:26203 postgresql:16-9080020260605131007.rhel9 Red Hat Enterprise Linux 9 2026-06-16T00:00:00Z RHSA-2026:26204 postgresql:18-9080020260605125734.rhel9 Red Hat Enterprise Linux 9 2026-06-22T00:00:00Z RHSA-2026:27741 postgresql-0:13.23-3.el9_8 Red Hat Enterprise Linux 9 2026-06-22T00:00:00Z RHSA-2026:28037 postgresql:15-9080020260605124405.rhel9 Red Hat Enterprise Linux 9 2026-07-23T00:00:00Z RHSA-2026:44308 libpq-0:13.23-3.el9_8 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-06-25T00:00:00Z RHSA-2026:29953 postgresql-0:13.23-1.el9_2.2 Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 2026-06-30T00:00:00Z RHSA-2026:33497 postgresql:15-9020020260625101129.rhel9 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-17T00:00:00Z RHSA-2026:26524 postgresql:16-9040020260612132455.rhel9 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-25T00:00:00Z RHSA-2026:29904 postgresql-0:13.23-1.el9_4.2 Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 2026-06-30T00:00:00Z RHSA-2026:33441 postgresql:15-9040020260616071806.rhel9 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-17T00:00:00Z RHSA-2026:26525 postgresql:16-9060020260612084605.rhel9 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-25T00:00:00Z RHSA-2026:29212 postgresql-0:13.23-1.el9_6.2 Red Hat Enterprise Linux 9.6 Extended Update Support 2026-06-29T00:00:00Z RHSA-2026:32983 postgresql:15-9060020260622062902.rhel9 Red Hat Hardened Images 2026-05-26T00:00:00Z RHSA-2026:21182 postgresql17-main-17.10-0.1.hum1 Red Hat Hardened Images 2026-06-03T00:00:00Z RHSA-2026:22878 postgresql18-main-18.4-0.1.hum1 Red Hat Update Infrastructure 5 2026-07-23T00:00:00Z RHSA-2026:44481 rhui5/rhua-rhel9:1784795076 Red Hat Enterprise Linux 6 Out of support scope postgresql Red Hat Enterprise Linux 7 Affected postgresql Red Hat Enterprise Linux 8 Not affected postgresql Red Hat Enterprise Linux 8 Not affected postgresql-jdbc Self-service automation portal 2 Affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-6477 https://nvd.nist.gov/vuln/detail/CVE-2026-6477 https://www.postgresql.org/support/security/CVE-2026-6477/