BSD PortsPostgreSQL -- multiple vulnerabilities
· CVE-2026-6460, CVE-2026-6464, CVE-2026-6467, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116310, CVE-2026-116311, CVE-2026-116312, CVE-2026-116313, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116318, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116322, CVE-2026-116323, CVE-2026-116325, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116329, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116333, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120142, CVE-2026-120143, CVE-2026-120144, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154 · VuXML entry
The PostgreSQL project reports: CVE-2026-6460: Add defenses against problems caused by altering composite types concurrently with operations on data of those types CVE-2026-6464: Ensure that psql counts all the COPY FROM STDIN commands appearing in a multi-query command string CVE-2026-6467: Prevent corrupting a newly-installed extension by renaming its target schema during CREATE EXTENSION or by installing it into …
Affected versions
- postgresql14-server, postgresql14-client, postgresql14-contrib, postgresql14-plperl, postgresql14-pltcl < 14.25
- postgresql15-server, postgresql15-client, postgresql15-contrib, postgresql15-plperl, postgresql15-pltcl < 15.20
- postgresql16-server, postgresql16-client, postgresql16-contrib, postgresql16-plperl, postgresql16-pltcl < 16.16
- postgresql17-server, postgresql17-client, postgresql17-contrib, postgresql17-plperl, postgresql17-pltcl < 17.12
- postgresql18-server, postgresql18-client, postgresql18-contrib, postgresql18-plperl, postgresql18-pltcl < 18.7
By system
25 still vulnerable, 25 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| FreeBSD | databases/postgresql14-server | 14.25 | fixed | |
| NetBSD | databases/postgresql14-server | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-server | 14.24 | in range, by version | |
| DragonFly | databases/postgresql14-server | 14.24 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql14-client | 14.25 | fixed | |
| NetBSD | databases/postgresql14-client | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-client | in range, by version | ||
| DragonFly | databases/postgresql14-client | 14.24 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql14-contrib | 14.25 | fixed | |
| NetBSD | databases/postgresql14-contrib | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-contrib | in range, by version | ||
| DragonFly | databases/postgresql14-contrib | 14.24 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql14-plperl | 14.25 | fixed | |
| NetBSD | databases/postgresql14-plperl | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-plperl | in range, by version | ||
| DragonFly | databases/postgresql14-plperl | 14.24 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql14-pltcl | 14.25 | fixed | |
| NetBSD | databases/postgresql14-pltcl | 14.24 | not listed | |
| MidnightBSD | databases/postgresql14-pltcl | in range, by version | ||
| DragonFly | databases/postgresql14-pltcl | 14.24 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql15-server | 15.20 | fixed | |
| NetBSD | databases/postgresql15-server | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-server | 15.19 | in range, by version | |
| DragonFly | databases/postgresql15-server | 15.19 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql15-client | 15.20 | fixed | |
| NetBSD | databases/postgresql15-client | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-client | in range, by version | ||
| DragonFly | databases/postgresql15-client | 15.19 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql15-contrib | 15.20 | fixed | |
| NetBSD | databases/postgresql15-contrib | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-contrib | in range, by version | ||
| DragonFly | databases/postgresql15-contrib | 15.19 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql15-plperl | 15.20 | fixed | |
| NetBSD | databases/postgresql15-plperl | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-plperl | in range, by version | ||
| DragonFly | databases/postgresql15-plperl | 15.19 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql15-pltcl | 15.20 | fixed | |
| NetBSD | databases/postgresql15-pltcl | 15.19 | not listed | |
| MidnightBSD | databases/postgresql15-pltcl | in range, by version | ||
| DragonFly | databases/postgresql15-pltcl | 15.19 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql16-server | 16.16 | fixed | |
| NetBSD | databases/postgresql16-server | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-server | 16.15 | in range, by version | |
| DragonFly | databases/postgresql16-server | 16.15 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql16-client | 16.16 | fixed | |
| NetBSD | databases/postgresql16-client | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-client | in range, by version | ||
| DragonFly | databases/postgresql16-client | 16.15 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql16-contrib | 16.16 | fixed | |
| NetBSD | databases/postgresql16-contrib | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-contrib | in range, by version | ||
| DragonFly | databases/postgresql16-contrib | 16.15 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql16-plperl | 16.16 | fixed | |
| NetBSD | databases/postgresql16-plperl | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-plperl | in range, by version | ||
| DragonFly | databases/postgresql16-plperl | 16.15 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql16-pltcl | 16.16 | fixed | |
| NetBSD | databases/postgresql16-pltcl | 16.15 | not listed | |
| MidnightBSD | databases/postgresql16-pltcl | in range, by version | ||
| DragonFly | databases/postgresql16-pltcl | 16.15 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql17-server | 17.12 | fixed | |
| NetBSD | databases/postgresql17-server | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-server | 17.11 | in range, by version | |
| DragonFly | databases/postgresql17-server | 17.11 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql17-client | 17.12 | fixed | |
| NetBSD | databases/postgresql17-client | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-client | in range, by version | ||
| DragonFly | databases/postgresql17-client | 17.11 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql17-contrib | 17.12 | fixed | |
| NetBSD | databases/postgresql17-contrib | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-contrib | in range, by version | ||
| DragonFly | databases/postgresql17-contrib | 17.11 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql17-plperl | 17.12 | fixed | |
| NetBSD | databases/postgresql17-plperl | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-plperl | in range, by version | ||
| DragonFly | databases/postgresql17-plperl | 17.11 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql17-pltcl | 17.12 | fixed | |
| NetBSD | databases/postgresql17-pltcl | 17.11 | not listed | |
| MidnightBSD | databases/postgresql17-pltcl | in range, by version | ||
| DragonFly | databases/postgresql17-pltcl | 17.11 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql18-server | 18.7 | fixed | |
| NetBSD | databases/postgresql18-server | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-server | 18.6 | in range, by version | |
| DragonFly | databases/postgresql18-server | 18.6 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql18-client | 18.7 | fixed | |
| NetBSD | databases/postgresql18-client | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-client | in range, by version | ||
| DragonFly | databases/postgresql18-client | 18.6 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql18-contrib | 18.7 | fixed | |
| NetBSD | databases/postgresql18-contrib | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-contrib | in range, by version | ||
| DragonFly | databases/postgresql18-contrib | 18.6 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql18-plperl | 18.7 | fixed | |
| NetBSD | databases/postgresql18-plperl | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-plperl | in range, by version | ||
| DragonFly | databases/postgresql18-plperl | 18.6 | vulnerable since 2026-11-12 | |
| FreeBSD | databases/postgresql18-pltcl | 18.7 | fixed | |
| NetBSD | databases/postgresql18-pltcl | 18.6 | not listed | |
| MidnightBSD | databases/postgresql18-pltcl | in range, by version | ||
| DragonFly | databases/postgresql18-pltcl | 18.6 | vulnerable since 2026-11-12 |