Threats Tagged 'cve-2026-6470'

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A missing authorization check in PostgreSQL allows an object creator to cause denial of service on ALTER and DROP operations of a type by creating dependencies on that type. This occurs because certain DDL commands, such as assigning a range subtype and referencing the type from an SQL expression, do not properly verify USAGE privileges. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. A patch is available to address this issue.

CVE-2026-6470 is a medium severity vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. It involves missing authorization checks in certain DDL commands related to types, allowing an object creator to cause denial of service by creating dependencies that prevent ALTER and DROP operations on the type. The vulnerability does not impact confidentiality or integrity but can cause availability issues.