CVE-2026-2004
CVE-2026-2004 · PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
CVSS 8.8 · High · EPSS 1.3% · Fix available
- Published
- Updated
Affected products and versions
postgresql
- Versions
- ≥ 18, < 18.2: Affected (rpm)
- ≥ 17, < 17.8: Affected (rpm)
- ≥ 16, < 16.12: Affected (rpm)
- ≥ 15, < 15.16: Affected (rpm)
- ≥ 0, < 14.21: Affected (rpm)
Update to 14.21; Update to 15.16; Update to 16.12; Update to 17.8; Update to 18.2
postgresql-15 Debian:12
- Versions
- 15.10-0+deb12u1
- 15.11-0+deb12u1
- 15.12-0+deb12u1
- 15.12-0+deb12u2
- 15.13-0+deb12u1
- 15.14-0+deb12u1
- 15.15-0+deb12u1
- 15.3-0+deb12u1
- 15.3-1
- 15.4-0+deb12u1
- 15.4-1
- 15.4-2
- 15.4-3
- 15.5-0+deb12u1
- 15.6-0+deb12u1
- 15.7-0+deb12u1
- 15.8-0+deb12u1
- 15.9-0+deb12u1
- Affected ranges
- ECOSYSTEM: < 15.16-0+deb12u1
Update to 15.16-0+deb12u1
postgresql-17 Debian:13
- Versions
- 17.5-1
- 17.6-0+deb13u1
- 17.6-1
- 17.7-0+deb13u1
- Affected ranges
- ECOSYSTEM: < 17.8-0+deb13u1
Update to 17.8-0+deb13u1
postgresql-18 Debian:14
- Versions
- 18.0-1
- 18.1-1
- 18.1-2
- 18~beta1+20250612-1
- 18~beta1+20250624-1
- 18~beta1+20250701-1
- 18~beta1-1
- 18~beta2-1
- 18~beta3-1
- 18~rc1-1
- 18~rc1-2
- 18~rc1-3
- 18~~devel.20250318+g4078da6c478-1
- 18~~devel.20250331-1
- 18~~devel.20250405-1
- 18~~devel.20250421-1
- 18~~devel.20250502-1
- Affected ranges
- ECOSYSTEM: < 18.2-1
Update to 18.2-1
postgresql-9.3 Ubuntu:Pro:14.04:LTS
- Versions
- 9.3.1-1
- 9.3.2-1
- 9.3.2-1ubuntu1
- 9.3.2-1ubuntu2
- 9.3.3-1
- 9.3.3-1bzr1
- 9.3.3-1bzr2
- 9.3.4-1
- 9.3.5-0ubuntu0.14.04.1
- 9.3.6-0ubuntu0.14.04
- 9.3.7-0ubuntu0.14.04
- 9.3.8-0ubuntu0.4.04
- 9.3.9-0ubuntu0.14.04
- 9.3.10-0ubuntu0.14.04
- 9.3.11-0ubuntu0.14.04
- 9.3.12-0ubuntu0.14.04
- 9.3.13-0ubuntu0.14.04
- 9.3.14-0ubuntu0.14.04
- 9.3.15-0ubuntu0.14.04
- 9.3.16-0ubuntu0.14.04
- 9.3.17-0ubuntu0.14.04
- 9.3.18-0ubuntu0.14.04.1
- 9.3.19-0ubuntu0.14.04
- 9.3.20-0ubuntu0.14.04
- 9.3.21-0ubuntu0.14.04
- 9.3.22-0ubuntu0.14.04
- 9.3.23-0ubuntu0.14.04
- 9.3.24-0ubuntu0.14.04
- 9.3.24-0ubuntu0.14.04+esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postgresql-9.5 Ubuntu:Pro:16.04:LTS
- Versions
- 9.5.0-1
- 9.5.0-2
- 9.5.0-3
- 9.5.1-1
- 9.5.2-1
- 9.5.3-0ubuntu0.16.04
- 9.5.4-0ubuntu0.16.04
- 9.5.5-0ubuntu0.16.04
- 9.5.6-0ubuntu0.16.04
- 9.5.7-0ubuntu0.16.04
- 9.5.8-0ubuntu0.16.04.1
- 9.5.9-0ubuntu0.16.04
- 9.5.10-0ubuntu0.16.04
- 9.5.11-0ubuntu0.16.04
- 9.5.12-0ubuntu0.16.04
- 9.5.13-0ubuntu0.16.04
- 9.5.14-0ubuntu0.16.04
- 9.5.16-0ubuntu0.16.04.1
- 9.5.17-0ubuntu0.16.04.1
- 9.5.18-0ubuntu0.16.04.1
- 9.5.19-0ubuntu0.16.04.1
- 9.5.21-0ubuntu0.16.04.1
- 9.5.23-0ubuntu0.16.04.1
- 9.5.24-0ubuntu0.16.04.1
- 9.5.25-0ubuntu0.16.04.1
- 9.5.25-0ubuntu0.16.04.1+esm1
- 9.5.25-0ubuntu0.16.04.1+esm2
- 9.5.25-0ubuntu0.16.04.1+esm3
- 9.5.25-0ubuntu0.16.04.1+esm4
- 9.5.25-0ubuntu0.16.04.1+esm5
- 9.5.25-0ubuntu0.16.04.1+esm6
- 9.5.25-0ubuntu0.16.04.1+esm7
- 9.5.25-0ubuntu0.16.04.1+esm8
- 9.5.25-0ubuntu0.16.04.1+esm10
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postgresql-10 Ubuntu:Pro:18.04:LTS
- Versions
- 10.1-1
- 10.1-2
- 10.2-1
- 10.3-1
- 10.4-0ubuntu0.18.04
- 10.5-0ubuntu0.18.04
- 10.6-0ubuntu0.18.04.1
- 10.7-0ubuntu0.18.04.1
- 10.8-0ubuntu0.18.04.1
- 10.9-0ubuntu0.18.04.1
- 10.10-0ubuntu0.18.04.1
- 10.12-0ubuntu0.18.04.1
- 10.14-0ubuntu0.18.04.1
- 10.15-0ubuntu0.18.04.1
- 10.16-0ubuntu0.18.04.1
- 10.17-0ubuntu0.18.04.1
- 10.18-0ubuntu0.18.04.1
- 10.19-0ubuntu0.18.04.1
- 10.20-0ubuntu0.18.04.1
- 10.21-0ubuntu0.18.04.1
- 10.22-0ubuntu0.18.04.1
- 10.23-0ubuntu0.18.04.1
- 10.23-0ubuntu0.18.04.2
- 10.23-0ubuntu0.18.04.2+esm1
- 10.23-0ubuntu0.18.04.2+esm2
- 10.23-0ubuntu0.18.04.2+esm3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postgresql-12 Ubuntu:20.04:LTS
- Versions
- 12.0-1
- 12.1-1
- 12.1-2build1
- 12.2-1
- 12.2-1ubuntu2
- 12.2-4
- 12.4-0ubuntu0.20.04.1
- 12.5-0ubuntu0.20.04.1
- 12.6-0ubuntu0.20.04.1
- 12.7-0ubuntu0.20.04.1
- 12.8-0ubuntu0.20.04.1
- 12.9-0ubuntu0.20.04.1
- 12.10-0ubuntu0.20.04.1
- 12.11-0ubuntu0.20.04.1
- 12.12-0ubuntu0.20.04.1
- 12.13-0ubuntu0.20.04.1
- 12.14-0ubuntu0.20.04.1
- 12.15-0ubuntu0.20.04.1
- 12.16-0ubuntu0.20.04.1
- 12.17-0ubuntu0.20.04.1
- 12.18-0ubuntu0.20.04.1
- 12.19-0ubuntu0.20.04.1
- 12.20-0ubuntu0.20.04.1
- 12.22-0ubuntu0.20.04.1
- 12.22-0ubuntu0.20.04.2
- 12.22-0ubuntu0.20.04.4
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
postgresql-14 Ubuntu:22.04:LTS
- Versions
- 14.1-1ubuntu1
- 14.2-1
- 14.2-1ubuntu1
- 14.3-0ubuntu0.22.04.1
- 14.4-0ubuntu0.22.04.1
- 14.5-0ubuntu0.22.04.1
- 14.6-0ubuntu0.22.04.1
- 14.7-0ubuntu0.22.04.1
- 14.8-0ubuntu0.22.04.1
- 14.9-0ubuntu0.22.04.1
- 14.10-0ubuntu0.22.04.1
- 14.11-0ubuntu0.22.04.1
- 14.12-0ubuntu0.22.04.1
- 14.13-0ubuntu0.22.04.1
- 14.15-0ubuntu0.22.04.1
- 14.17-0ubuntu0.22.04.1
- 14.18-0ubuntu0.22.04.1
- 14.19-0ubuntu0.22.04.1
- 14.20-0ubuntu0.22.04.1
- Affected ranges
- ECOSYSTEM: < 14.22-0ubuntu0.22.04.1
Update to 14.22-0ubuntu0.22.04.1
postgresql-16 Ubuntu:24.04:LTS
- Versions
- 16.0-2
- 16.1-1
- 16.1-1build1
- 16.1-1build3
- 16.2-1
- 16.2-1ubuntu2
- 16.2-1ubuntu3
- 16.2-1ubuntu4
- 16.3-0ubuntu0.24.04.1
- 16.4-0ubuntu0.24.04.1
- 16.4-0ubuntu0.24.04.2
- 16.6-0ubuntu0.24.04.1
- 16.8-0ubuntu0.24.04.1
- 16.9-0ubuntu0.24.04.1
- 16.10-0ubuntu0.24.04.1
- 16.11-0ubuntu0.24.04.1
- Affected ranges
- ECOSYSTEM: < 16.13-0ubuntu0.24.04.1
Update to 16.13-0ubuntu0.24.04.1
postgresql-17 Ubuntu:25.10
- Versions
- 17.4-1
- 17.4-2
- 17.5-1
- 17.5-1build1
- 17.6-1
- 17.6-1build1
- 17.7-0ubuntu0.25.10.1
- Affected ranges
- ECOSYSTEM: < 17.9-0ubuntu0.25.10.1
Update to 17.9-0ubuntu0.25.10.1
Original sources
- https://www.postgresql.org/support/security/CVE-2026-2004/
- https://access.redhat.com/security/cve/CVE-2026-2004
- https://bugzilla.redhat.com/show_bug.cgi?id=2439325
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2004.json
- https://access.redhat.com/errata/RHSA-2026:4441
- https://access.redhat.com/errata/RHSA-2026:3887
- https://access.redhat.com/errata/RHSA-2026:19010
- https://access.redhat.com/errata/RHSA-2026:19009
- https://access.redhat.com/errata/RHSA-2026:4064
- https://access.redhat.com/errata/RHSA-2026:4024
- https://access.redhat.com/errata/RHSA-2026:4059
- https://access.redhat.com/errata/RHSA-2026:4063
- https://access.redhat.com/errata/RHSA-2026:4506
- https://access.redhat.com/errata/RHSA-2026:4509
- https://access.redhat.com/errata/RHSA-2026:4504
- https://access.redhat.com/errata/RHSA-2026:4505
- https://access.redhat.com/errata/RHSA-2026:4516
- https://access.redhat.com/errata/RHSA-2026:4075
- https://access.redhat.com/errata/RHSA-2026:4074
- https://access.redhat.com/errata/RHSA-2026:4515
- https://access.redhat.com/errata/RHSA-2026:4518
- https://access.redhat.com/errata/RHSA-2026:4254
- https://access.redhat.com/errata/RHSA-2026:4475
- https://nvd.nist.gov/vuln/detail/CVE-2026-2004