PostgreSQL -- Multiple vulnerabilities

2026-05-14 · CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475, CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479, CVE-2026-6575, CVE-2026-6637, CVE-2026-6538 · VuXML entry

The PostgreSQL project reports: Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Integer wraparound in multiple PostgreSQL server features allows an application input provider to cause the server …

Affected versions

• postgresql14-server < 14.23
• postgresql15-server < 15.18
• postgresql16-server < 16.14
• postgresql17-server < 17.10
• postgresql18-server < 18.4
• postgresql14-client < 14.23
• postgresql15-client < 15.18
• postgresql16-client < 16.14
• postgresql17-client < 17.10
• postgresql18-client < 18.4

By system

8 still vulnerable, 10 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.