Threats Tagged 'cve-2026-14672'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A vulnerability in PostgreSQL's SCRAM authentication mechanism allows an unauthenticated attacker to determine if a user exists by observing differences in the SCRAM iteration count in authentication responses. This issue affects PostgreSQL major versions 16 through 18, specifically versions before 16.15, 17.11, and 18.5. Versions prior to 16 are not affected. The vulnerability arises because the authentication challenge for nonexistent users always reports the default iteration count, while users with non-default scram_iterations reveal a different count, enabling a user existence oracle.

CVE-2026-14672 is a medium severity vulnerability in PostgreSQL versions 16 through 18 prior to specific minor releases. It involves an observable response discrepancy in SCRAM authentication that allows unauthenticated users to test for the existence of a database user by observing differences in the SCRAM iteration count. This issue only affects users with non-default scram_iterations settings. Versions before PostgreSQL 16 are not affected.