Threats Tagged 'cve-2026-14681'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

PostgreSQL versions 17 and 18 prior to 17.11 and 18.6 respectively have an issue where GSSAPI message integrity enforcement is improperly handled when used with SSL. This allows a connection to negotiate GSSAPI authentication contrary to pg_hba.conf rules by initially using a direct TLS connection. If TLS settings are more permissive than GSSAPI settings, the connection may proceed with weaker protection than intended. Versions before 17 are not affected. A patch is available to address this issue.

CVE-2026-14681 is a vulnerability in PostgreSQL's GSSAPI support where message integrity enforcement during transmission is improper. This allows a user to negotiate GSSAPI authentication contrary to the pg_hba.conf configuration via an initial direct TLS connection. If TLS settings are more permissive than GSSAPI settings, the connection may proceed with weaker protection. The issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.11 and 18.6. Versions before 17 are not affected.