p PatchFirst

PatchFirst · Latest vulnerabilities

postgresql 16.14: known vulnerabilities · Page 2

Known vulnerabilities affecting postgresql 16.14: 25. Compare the fixes below with your installed release.

RSS ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 25

  1. CVE-2026-14668

    High · CVSS 8.1EPSS 0.33%Fix available

    PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read

    Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    postgresqlDatabases
    • Update to 16.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2026-14666

    Medium · CVSS 4.2EPSS 0.18%Fix available

    PostgreSQL row security caching disregards role modifications

    Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and

    postgresqlDatabases
    • Update to 16.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2026-14664

    High · CVSS 8.8EPSS 0.44%Fix available

    PostgreSQL regexp heap buffer overflow executes arbitrary code

    Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    postgresqlDatabases
    • Update to 16.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2026-14663

    Medium · CVSS 6.5EPSS 0.1%Fix available

    PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

    Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.1

    postgresqlDatabases
    • Update to 16.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2026-14662

    High · CVSS 8.8EPSS 0.46%Fix available

    PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

    Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

    postgresqlDatabases
    • Update to 16.15
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →