REDHAT-BUG-2515332: SQL Injection

Q: Who can exploit this issue?

An attacker needs to be an object owner who can create or control a hostile object definition. Successful exploitation can cause arbitrary SQL to run with superuser privileges when a vulnerable expression-deparse consumer processes that object.

Q: Which activities can trigger the vulnerable code path?

The issue affects expression deparse consumers broadly. Known examples include pg_dump, psql commands such as \sf, and similar functionality in non-core tools.

Q: Which PostgreSQL releases need to be updated?

Versions earlier than PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the applicable listed release or a later release.

Q: What can be done if patching is not immediately possible?

Avoid running pg_dump, psql deparse commands such as \sf, and comparable expression-deparse tools against databases containing objects defined by untrusted owners. Restrict untrusted users from owning or creating hostile object definitions until an update can be applied.

Published Aug 13, 2026

Updated

SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pgdump, psql commands like \sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected Software

1 affected component

PostgreSQL postgresql<18.5, <17.11, <16.15, <15.19, <14.24

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.5
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.11
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.15
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.19
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.24

Event History

Aug 13, 2026

Data Sourced

via Red Hat·01:32 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be an object owner who can create or control a hostile object definition. Successful exploitation can cause arbitrary SQL to run with superuser privileges when a vulnerable expression-deparse consumer processes that object.

Which activities can trigger the vulnerable code path?

The issue affects expression deparse consumers broadly. Known examples include pg_dump, psql commands such as \sf, and similar functionality in non-core tools.

Which PostgreSQL releases need to be updated?

Versions earlier than PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. Update to the applicable listed release or a later release.

What can be done if patching is not immediately possible?

Avoid running pg_dump, psql deparse commands such as \sf, and comparable expression-deparse tools against databases containing objects defined by untrusted owners. Restrict untrusted users from owning or creating hostile object definitions until an update can be applied.

REDHAT-BUG-2515332: SQL Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

Which activities can trigger the vulnerable code path?

Which PostgreSQL releases need to be updated?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Which activities can trigger the vulnerable code path?

Which PostgreSQL releases need to be updated?

What can be done if patching is not immediately possible?