Threats Tagged 'cve-2026-6476'

This security update for postgresql17 addresses multiple vulnerabilities by updating to version 17. 10. The fixes include privilege checks, integer overflow prevention, protection against malicious time zone names, path traversal prevention, proper quoting of subscription and object names, marking unsafe functions, timing-safe string comparisons, recursion limits, and prevention of SQL injection and buffer overruns. Non-security improvements related to system updates are also included.

CVE-2026-6476 is a high-severity SQL injection vulnerability in PostgreSQL affecting versions 17 and 18 prior to 17. 10 and 18. 4, respectively. It allows an attacker with pg_create_subscription rights to execute arbitrary SQL commands with superuser privileges when the pg_createsubscriber function runs. Versions before PostgreSQL 17 are not affected. There is no confirmed patch or official remediation information available at this time.