DEBIAN-CVE-2026-120144: High severity debian/postgresql-18 vulnerability
Published Nov 12, 2026
·Updated
Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
1 affected component
debian/postgresql-18*
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7
Event History
Nov 12, 2026
CVE Published
via OSV·03:17 PM
Data Sourced
via OSV·03:17 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which Debian PostgreSQL packages are identified as affected?
The affected packages listed are debian/postgresql-15, debian/postgresql-17, and debian/postgresql-18.
2
What level of access does an attacker need according to the severity vector?
The vector indicates network access is sufficient, with low attack complexity and low privileges required. No user interaction is required.