AZL-113729: CVE-2026-116327 affecting package postgresql 16.15-1
Exposure of sensitive information in PostgreSQL securitybarrier processing allows a database user to infer values hidden by a securitybarrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
A database user who can apply a leaky function in a query involving a security_barrier view may be able to infer values that the view is intended to hide.
Are deployments using PostgreSQL 16.15 affected?
Yes. PostgreSQL versions before 16.16 are affected, so package version 16.15-1 falls within the affected range.
How can I tell whether my PostgreSQL instance is vulnerable?
Check the PostgreSQL major and minor version in use. Affected versions are those earlier than 18.7, 17.12, 16.16, 15.20, or 14.25 for their respective major release lines.