Threats Tagged 'cve-2026-14671'

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A type confusion vulnerability exists in the PostgreSQL refint module that allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This issue affects multiple PostgreSQL versions prior to 14.24, 15.19, 16.15, 17.11, and 18.5. The vulnerability was fixed by removing the plan cache in the refint module, with the fix available in the PostgreSQL git repository. No known exploits are reported in the wild.

CVE-2026-14671 is a high-severity type confusion vulnerability in the PostgreSQL refint module. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. The issue affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. A fix was introduced as part of a non-security bug report that removed the plan cache in the refint module. The vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.