REDHAT-BUG-2515316: High severity PostgreSQL postgresql vulnerability

Q: Who can exploit this issue?

An attacker needs to be able to act as a PostgreSQL user and recreate a cursor or other portal with different types. Successful exploitation can execute code as the operating system account running the database server.

Q: Which PostgreSQL releases need remediation?

PostgreSQL releases before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the applicable fixed release or a later release.

Q: What is the impact if exploitation succeeds?

The attacker can execute arbitrary code with the privileges of the operating system user that runs PostgreSQL. This can extend beyond database-level access to the host context available to that service account.

Published Aug 13, 2026

Updated

Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be able to act as a PostgreSQL user and recreate a cursor or other portal with different types. Successful exploitation can execute code as the operating system account running the database server.

Which PostgreSQL releases need remediation?

PostgreSQL releases before 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the applicable fixed release or a later release.

What is the impact if exploitation succeeds?

The attacker can execute arbitrary code with the privileges of the operating system user that runs PostgreSQL. This can extend beyond database-level access to the host context available to that service account.

REDHAT-BUG-2515316: High severity PostgreSQL postgresql vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL releases need remediation?

What is the impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which PostgreSQL releases need remediation?

What is the impact if exploitation succeeds?