Threats Tagged 'cve-2026-6473'

This security update for postgresql17 addresses multiple vulnerabilities by updating to version 17. 10. The fixes include privilege checks, integer overflow prevention, protection against malicious time zone names, path traversal prevention, proper quoting of subscription and object names, marking unsafe functions, timing-safe string comparisons, recursion limits, and prevention of SQL injection and buffer overruns. Non-security improvements related to system updates are also included.

CVE-2026-6473 is an integer overflow or wraparound vulnerability in multiple PostgreSQL server features. It allows an unprivileged database user to cause the server to undersize memory allocations and write out-of-bounds, potentially leading to arbitrary code execution with the privileges of the database operating system user. Applications passing very large user inputs to affected database functions may experience segmentation faults. Versions prior to PostgreSQL 18. 4, 17. 10, 16. 14, 15. 18, and 14. 23 are affected.