REDHAT-BUG-2515314: High severity PostgreSQL postgresql vulnerability

Q: Which PostgreSQL versions need to be updated?

PostgreSQL releases before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the corresponding fixed release or a later release in the same supported branch.

Q: What access does an attacker need to exploit this issue?

An attacker needs to be able to submit SQL that invokes the fuzzystrmatch extension's levenshtein() or levenshtein_less_equal() function with extreme inputs. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

Q: Are systems affected if fuzzystrmatch is not in use?

The issue is in the fuzzystrmatch implementation of levenshtein() and levenshtein_less_equal(). The provided information does not establish exposure for installations where those functions are unavailable or cannot be invoked.

Published Aug 13, 2026

Updated

Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshteinlessequal(). Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which PostgreSQL versions need to be updated?

PostgreSQL releases before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the corresponding fixed release or a later release in the same supported branch.

What access does an attacker need to exploit this issue?

An attacker needs to be able to submit SQL that invokes the fuzzystrmatch extension's levenshtein() or levenshtein_less_equal() function with extreme inputs. Successful exploitation can execute arbitrary code as the operating system user that runs the database.

Are systems affected if fuzzystrmatch is not in use?

The issue is in the fuzzystrmatch implementation of levenshtein() and levenshtein_less_equal(). The provided information does not establish exposure for installations where those functions are unavailable or cannot be invoked.

REDHAT-BUG-2515314: High severity PostgreSQL postgresql vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which PostgreSQL versions need to be updated?

What access does an attacker need to exploit this issue?

Are systems affected if fuzzystrmatch is not in use?

Company

Resources

Contact

Frequently Asked Questions

Which PostgreSQL versions need to be updated?

What access does an attacker need to exploit this issue?

Are systems affected if fuzzystrmatch is not in use?