CVE-2026-14663: PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgpsymencrypt, pgpsymdecrypt, pgppubencrypt, pgppubdecrypt, pgpsymencryptbytea, pgpsymdecryptbytea, pgppubencryptbytea, and pgppubdecryptbytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Other sources
PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.15-1 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 18.6 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 17.11 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 16.15 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 15.19 - Upgrade
Upgrade
PostgreSQL pgcryptoto a version that resolves this vulnerability.Fixed in 14.24
Event History
Frequently Asked Questions
What is the severity of CVE-2026-14663?
The severity of CVE-2026-14663 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-14663?
To fix CVE-2026-14663, update PostgreSQL pgcrypto to a version that addresses the issue with OpenSSL-disabled ciphers.
What does CVE-2026-14663 affect?
CVE-2026-14663 affects the PostgreSQL pgcrypto extension, specifically regarding its handling of OpenSSL-disabled ciphers.
What are the risks associated with CVE-2026-14663?
The risks associated with CVE-2026-14663 include the potential for sensitive data to be exposed due to the recovery of cleartext from faulty ciphertext.
Can CVE-2026-14663 lead to unauthorized data access?
Yes, CVE-2026-14663 can lead to unauthorized data access if encrypted data is processed without appropriate validation.