p PatchFirst

CVE-2026-6637

CVE-2026-6637 · PostgreSQL refint allows stack buffer overflow and SQL injection

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVSS 8.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system · database

Affected products and versions

  • postgresql

    Versions
    • ≥ 18, < 18.4: Affected (rpm)
    • ≥ 17, < 17.10: Affected (rpm)
    • ≥ 16, < 16.14: Affected (rpm)
    • ≥ 15, < 15.18: Affected (rpm)
    • ≥ 0, < 14.23: Affected (rpm)

    Update to 14.23; Update to 15.18; Update to 16.14; Update to 17.10; Update to 18.4

  • postgresql-15 Debian:12

    Versions
    • 15.10-0+deb12u1
    • 15.11-0+deb12u1
    • 15.12-0+deb12u1
    • 15.12-0+deb12u2
    • 15.13-0+deb12u1
    • 15.14-0+deb12u1
    • 15.15-0+deb12u1
    • 15.16-0+deb12u1
    • 15.17-0+deb12u1
    • 15.3-0+deb12u1
    • 15.3-1
    • 15.4-0+deb12u1
    • 15.4-1
    • 15.4-2
    • 15.4-3
    • 15.5-0+deb12u1
    • 15.6-0+deb12u1
    • 15.7-0+deb12u1
    • 15.8-0+deb12u1
    • 15.9-0+deb12u1
    Affected ranges
    • ECOSYSTEM: < 15.18-0+deb12u1

    Update to 15.18-0+deb12u1

  • postgresql-17 Debian:13

    Versions
    • 17.5-1
    • 17.6-0+deb13u1
    • 17.6-1
    • 17.7-0+deb13u1
    • 17.8-0+deb13u1
    • 17.9-0+deb13u1
    Affected ranges
    • ECOSYSTEM: < 17.10-0+deb13u1

    Update to 17.10-0+deb13u1

  • postgresql-18 Debian:14

    Versions
    • 18.0-1
    • 18.1-1
    • 18.1-2
    • 18.2-1
    • 18.3-1
    • 18~beta1+20250612-1
    • 18~beta1+20250624-1
    • 18~beta1+20250701-1
    • 18~beta1-1
    • 18~beta2-1
    • 18~beta3-1
    • 18~rc1-1
    • 18~rc1-2
    • 18~rc1-3
    • 18~~devel.20250318+g4078da6c478-1
    • 18~~devel.20250331-1
    • 18~~devel.20250405-1
    • 18~~devel.20250421-1
    • 18~~devel.20250502-1
    Affected ranges
    • ECOSYSTEM: < 18.4-1

    Update to 18.4-1

  • postgresql-9.3 Ubuntu:Pro:14.04:LTS

    Versions
    • 9.3.1-1
    • 9.3.2-1
    • 9.3.2-1ubuntu1
    • 9.3.2-1ubuntu2
    • 9.3.3-1
    • 9.3.3-1bzr1
    • 9.3.3-1bzr2
    • 9.3.4-1
    • 9.3.5-0ubuntu0.14.04.1
    • 9.3.6-0ubuntu0.14.04
    • 9.3.7-0ubuntu0.14.04
    • 9.3.8-0ubuntu0.4.04
    • 9.3.9-0ubuntu0.14.04
    • 9.3.10-0ubuntu0.14.04
    • 9.3.11-0ubuntu0.14.04
    • 9.3.12-0ubuntu0.14.04
    • 9.3.13-0ubuntu0.14.04
    • 9.3.14-0ubuntu0.14.04
    • 9.3.15-0ubuntu0.14.04
    • 9.3.16-0ubuntu0.14.04
    • 9.3.17-0ubuntu0.14.04
    • 9.3.18-0ubuntu0.14.04.1
    • 9.3.19-0ubuntu0.14.04
    • 9.3.20-0ubuntu0.14.04
    • 9.3.21-0ubuntu0.14.04
    • 9.3.22-0ubuntu0.14.04
    • 9.3.23-0ubuntu0.14.04
    • 9.3.24-0ubuntu0.14.04
    • 9.3.24-0ubuntu0.14.04+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postgresql-9.5 Ubuntu:Pro:16.04:LTS

    Versions
    • 9.5.0-1
    • 9.5.0-2
    • 9.5.0-3
    • 9.5.1-1
    • 9.5.2-1
    • 9.5.3-0ubuntu0.16.04
    • 9.5.4-0ubuntu0.16.04
    • 9.5.5-0ubuntu0.16.04
    • 9.5.6-0ubuntu0.16.04
    • 9.5.7-0ubuntu0.16.04
    • 9.5.8-0ubuntu0.16.04.1
    • 9.5.9-0ubuntu0.16.04
    • 9.5.10-0ubuntu0.16.04
    • 9.5.11-0ubuntu0.16.04
    • 9.5.12-0ubuntu0.16.04
    • 9.5.13-0ubuntu0.16.04
    • 9.5.14-0ubuntu0.16.04
    • 9.5.16-0ubuntu0.16.04.1
    • 9.5.17-0ubuntu0.16.04.1
    • 9.5.18-0ubuntu0.16.04.1
    • 9.5.19-0ubuntu0.16.04.1
    • 9.5.21-0ubuntu0.16.04.1
    • 9.5.23-0ubuntu0.16.04.1
    • 9.5.24-0ubuntu0.16.04.1
    • 9.5.25-0ubuntu0.16.04.1
    • 9.5.25-0ubuntu0.16.04.1+esm1
    • 9.5.25-0ubuntu0.16.04.1+esm2
    • 9.5.25-0ubuntu0.16.04.1+esm3
    • 9.5.25-0ubuntu0.16.04.1+esm4
    • 9.5.25-0ubuntu0.16.04.1+esm5
    • 9.5.25-0ubuntu0.16.04.1+esm6
    • 9.5.25-0ubuntu0.16.04.1+esm7
    • 9.5.25-0ubuntu0.16.04.1+esm8
    • 9.5.25-0ubuntu0.16.04.1+esm10
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postgresql-10 Ubuntu:Pro:18.04:LTS

    Versions
    • 10.1-1
    • 10.1-2
    • 10.2-1
    • 10.3-1
    • 10.4-0ubuntu0.18.04
    • 10.5-0ubuntu0.18.04
    • 10.6-0ubuntu0.18.04.1
    • 10.7-0ubuntu0.18.04.1
    • 10.8-0ubuntu0.18.04.1
    • 10.9-0ubuntu0.18.04.1
    • 10.10-0ubuntu0.18.04.1
    • 10.12-0ubuntu0.18.04.1
    • 10.14-0ubuntu0.18.04.1
    • 10.15-0ubuntu0.18.04.1
    • 10.16-0ubuntu0.18.04.1
    • 10.17-0ubuntu0.18.04.1
    • 10.18-0ubuntu0.18.04.1
    • 10.19-0ubuntu0.18.04.1
    • 10.20-0ubuntu0.18.04.1
    • 10.21-0ubuntu0.18.04.1
    • 10.22-0ubuntu0.18.04.1
    • 10.23-0ubuntu0.18.04.1
    • 10.23-0ubuntu0.18.04.2
    • 10.23-0ubuntu0.18.04.2+esm1
    • 10.23-0ubuntu0.18.04.2+esm2
    • 10.23-0ubuntu0.18.04.2+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postgresql-12 Ubuntu:20.04:LTS

    Versions
    • 12.0-1
    • 12.1-1
    • 12.1-2build1
    • 12.2-1
    • 12.2-1ubuntu2
    • 12.2-4
    • 12.4-0ubuntu0.20.04.1
    • 12.5-0ubuntu0.20.04.1
    • 12.6-0ubuntu0.20.04.1
    • 12.7-0ubuntu0.20.04.1
    • 12.8-0ubuntu0.20.04.1
    • 12.9-0ubuntu0.20.04.1
    • 12.10-0ubuntu0.20.04.1
    • 12.11-0ubuntu0.20.04.1
    • 12.12-0ubuntu0.20.04.1
    • 12.13-0ubuntu0.20.04.1
    • 12.14-0ubuntu0.20.04.1
    • 12.15-0ubuntu0.20.04.1
    • 12.16-0ubuntu0.20.04.1
    • 12.17-0ubuntu0.20.04.1
    • 12.18-0ubuntu0.20.04.1
    • 12.19-0ubuntu0.20.04.1
    • 12.20-0ubuntu0.20.04.1
    • 12.22-0ubuntu0.20.04.1
    • 12.22-0ubuntu0.20.04.2
    • 12.22-0ubuntu0.20.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • postgresql-14 Ubuntu:22.04:LTS

    Versions
    • 14.1-1ubuntu1
    • 14.2-1
    • 14.2-1ubuntu1
    • 14.3-0ubuntu0.22.04.1
    • 14.4-0ubuntu0.22.04.1
    • 14.5-0ubuntu0.22.04.1
    • 14.6-0ubuntu0.22.04.1
    • 14.7-0ubuntu0.22.04.1
    • 14.8-0ubuntu0.22.04.1
    • 14.9-0ubuntu0.22.04.1
    • 14.10-0ubuntu0.22.04.1
    • 14.11-0ubuntu0.22.04.1
    • 14.12-0ubuntu0.22.04.1
    • 14.13-0ubuntu0.22.04.1
    • 14.15-0ubuntu0.22.04.1
    • 14.17-0ubuntu0.22.04.1
    • 14.18-0ubuntu0.22.04.1
    • 14.19-0ubuntu0.22.04.1
    • 14.20-0ubuntu0.22.04.1
    • 14.22-0ubuntu0.22.04.1
    Affected ranges
    • ECOSYSTEM: < 14.23-0ubuntu0.22.04.1

    Update to 14.23-0ubuntu0.22.04.1

  • postgresql-16 Ubuntu:24.04:LTS

    Versions
    • 16.0-2
    • 16.1-1
    • 16.1-1build1
    • 16.1-1build3
    • 16.2-1
    • 16.2-1ubuntu2
    • 16.2-1ubuntu3
    • 16.2-1ubuntu4
    • 16.3-0ubuntu0.24.04.1
    • 16.4-0ubuntu0.24.04.1
    • 16.4-0ubuntu0.24.04.2
    • 16.6-0ubuntu0.24.04.1
    • 16.8-0ubuntu0.24.04.1
    • 16.9-0ubuntu0.24.04.1
    • 16.10-0ubuntu0.24.04.1
    • 16.11-0ubuntu0.24.04.1
    • 16.13-0ubuntu0.24.04.1
    Affected ranges
    • ECOSYSTEM: < 16.14-0ubuntu0.24.04.1

    Update to 16.14-0ubuntu0.24.04.1

  • postgresql-17 Ubuntu:25.10

    Versions
    • 17.4-1
    • 17.4-2
    • 17.5-1
    • 17.5-1build1
    • 17.6-1
    • 17.6-1build1
    • 17.7-0ubuntu0.25.10.1
    • 17.9-0ubuntu0.25.10.1
    Affected ranges
    • ECOSYSTEM: < 17.10-0ubuntu0.25.10.1

    Update to 17.10-0ubuntu0.25.10.1

  • postgresql-18 Ubuntu:26.04:LTS

    Versions
    • 18.0-1
    • 18.1-1
    • 18.1-1ubuntu1
    • 18.1-1ubuntu2
    • 18.1-2
    • 18.3-1
    Affected ranges
    • ECOSYSTEM: < 18.4-0ubuntu0.26.04.1

    Update to 18.4-0ubuntu0.26.04.1

Original sources

Check your server →