Threats Tagged 'cve-2026-14670'

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A heap buffer overflow vulnerability exists in the PostgreSQL plperl extension when returning a tied hash. This flaw allows the function owner to execute arbitrary code with the privileges of the operating system user running the database. Versions prior to PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 are affected. A patch is available to address this issue.

CVE-2026-14670 is a heap-based buffer overflow vulnerability in the PostgreSQL plperl extension. It allows a function owner to execute arbitrary code as the operating system user running the database by exploiting a crafted function body that returns a tied hash. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability has a high severity with a CVSS score of 8.8.