REDHAT-BUG-2515311: Buffer Overflow

Q: Which PostgreSQL releases need to be updated?

Affected releases are PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. Update to the corresponding listed release or a later release in the applicable supported branch.

Q: What access does an attacker need to exploit this issue?

The attacker must be able to author and execute a PostgreSQL query. The issue is triggered using text that would not pass encoding validation.

Q: What is the security impact if exploitation succeeds?

A successful exploit can allow arbitrary code execution as the operating system user that runs the PostgreSQL database service.

Published Aug 13, 2026

Updated

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pgwchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:28 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which PostgreSQL releases need to be updated?

Affected releases are PostgreSQL versions before 18.5, 17.11, 16.15, 15.19, and 14.24. Update to the corresponding listed release or a later release in the applicable supported branch.

What access does an attacker need to exploit this issue?

The attacker must be able to author and execute a PostgreSQL query. The issue is triggered using text that would not pass encoding validation.

What is the security impact if exploitation succeeds?

A successful exploit can allow arbitrary code execution as the operating system user that runs the PostgreSQL database service.

REDHAT-BUG-2515311: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which PostgreSQL releases need to be updated?

What access does an attacker need to exploit this issue?

What is the security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which PostgreSQL releases need to be updated?

What access does an attacker need to exploit this issue?

What is the security impact if exploitation succeeds?