REDHAT-BUG-2515308: High severity PostgreSQL postgresql vulnerability

Q: Who can exploit this issue?

Any database user can exploit it by calling functions that have arguments of PostgreSQL's internal data type. Successful exploitation can result in arbitrary code execution as the operating system account running the database.

Q: Which PostgreSQL versions need to be updated?

Versions earlier than PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the corresponding fixed release or later.

Published Aug 13, 2026

Updated

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:27 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

Any database user can exploit it by calling functions that have arguments of PostgreSQL's internal data type. Successful exploitation can result in arbitrary code execution as the operating system account running the database.

Which PostgreSQL versions need to be updated?

Versions earlier than PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the corresponding fixed release or later.

REDHAT-BUG-2515308: High severity PostgreSQL postgresql vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL versions need to be updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL versions need to be updated?