Databases stack vulnerabilities · Page 12

RabbitMQ: UNC SSRF affecting the management UI on Windows

RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static can pass URL-encoded backslashes to erl_prim_loader:read_file_info before path validation when multiple management extension plugins are enabled, causing outbound DNS and SMB requests to attacker-controlled UNC paths. This issue is fixed in versions 4.1.11 and 4.2.6.

RabbitMQ management HTTP API accepts request bodies larger than configured max_http_body_size

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_management HTTP API accepts oversized valid JSON bodies on with_decode and direct_request paths because read_complete_body checks the accumulated size before the final chunk but not the final combined size. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

• Update to 4.3.0-2

RabbitMQ: Stored XSS federation management plugin via unsanitized consumer_tag rendering

RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5.

• Update to 4.3.0-2

CVE-2026-46863

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1

• Update to 8.0.46-0ubuntu0.20.04.1+esm3
• Update to 8.0.46-0ubuntu0.22.04.3
• Update to 8.0.46-0ubuntu0.24.04.3
• Update to 8.4.10-0ubuntu0.25.10.1
• Update to 8.4.10-0ubuntu0.26.04.1

RabbitMQ: Unsanitized vhost names allow for XSS in management UI

RabbitMQ is a messaging and streaming broker. From 3.7.0 to before 4.1.2 and 4.0.13, This vulnerability is fixed in 4.1.2 and 4.0.13.

• Update to 4.3.0-2

RabbitMQ MQTT Topic Permission Authorization Bypass

RabbitMQ is a messaging and streaming broker. From 4.2.0 to before 4.2.4, RabbitMQ's MQTT plugin allows for topic-level authorization using regular expressions with variable substitution. Administrators can create patterns such as ^{client_id}-sensors$ to restrict user access to topics that include their client ID. However, the client_id is provided by the user in the MQTT CONNECT packet and is inserted into the regex pattern without escaping special regex characters. This flaw enables an authenticated MQTT user to inject regex operators to bypass authorization. This vulnerability is fixed in 4.2.4 and 4.3.0.

CVE-2026-47784

In memcached before 1.6.42, password data for SASL password database authentication has a timing side channel because memcmp is used by sasl_server_userdb_checkpass.

• Update to 1.6.14-1ubuntu0.2
• Update to 1.6.18-1+deb12u1
• Update to 1.6.24-1ubuntu0.1
• Update to 1.6.38-1ubuntu0.1
• Update to 1.6.40-1ubuntu0.1
• Update to 1.6.42
• Update to 1.6.42-1

CVE-2026-47783

In memcached before 1.6.42, username data for SASL password database authentication has a timing side channel because a loop exits as soon as a valid username is found by sasl_server_userdb_checkpass.

• Update to 1.6.14-1ubuntu0.2
• Update to 1.6.18-1+deb12u1
• Update to 1.6.24-1ubuntu0.1
• Update to 1.6.38-1ubuntu0.1
• Update to 1.6.40-1ubuntu0.1
• Update to 1.6.42
• Update to 1.6.42-1

PostgreSQL REFRESH PUBLICATION allows SQL injection via table name

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

• Update to 14.23-0ubuntu0.22.04.1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL refint allows stack buffer overflow and SQL injection

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

• Update to 14.23-0ubuntu0.22.04.1
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL discloses MD5-hashed passwords via covert timing channel

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL pg_createsubscriber allows SQL injection via subscription name

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

• Update to 14.23-0ubuntu0.22.04.1
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL timeofday() can disclose portions of server memory

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL server undersizes allocations, via integer wraparound

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.19-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0ubuntu0.25.10.1
• Update to 17.11-0+deb13u1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

• Update to 14.23
• Update to 14.23-0ubuntu0.22.04.1
• Update to 15.18
• Update to 15.18-0+deb12u1
• Update to 16.14
• Update to 16.14-0ubuntu0.24.04.1
• Update to 17.10
• Update to 17.10-0+deb13u1
• Update to 17.10-0ubuntu0.25.10.1
• Update to 18.4
• Update to 18.4-0ubuntu0.26.04.1
• Update to 18.4-1

redis-server RESTORE invalid memory access may allow remote code execution

Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serialized values. An authenticated attacker with permission to execute RESTORE can supply a crafted serialized payload that triggers invalid memory access and may lead to remote code execution. A workaround is to restrict access to the RESTORE command with ACL rules. This is patched in version 8.6.3.

• Update to 5:7.0.15-1~deb12u8
• Update to 5:8.0.2-3+deb13u3
• Update to 5:8.0.6-3
• Update to 9.1.1-1