CVE catalog

CVE-2026-6475

Severity: High · CVSS 8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: May 14, 2026, 1:00:11 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 25, 2026

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	postgresql-15	bookworm	`15.18-0+deb12u1`	fixed
Debian	postgresql-15	bookworm-security	`15.19-0+deb12u1`	fixed
Cpe	postgresql-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg-compat3	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg-dev	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg6	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpgtypes3	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpq-dev	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpq5	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-client-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-doc-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-plperl-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-plpython3-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-pltcl-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-server-dev-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql	Not reported	`14.23`	fixed
Cpe	postgresql	Not reported	`15.18`	fixed
Cpe	postgresql	Not reported	`16.14`	fixed
Cpe	postgresql	Not reported	`17.10`	fixed
Cpe	postgresql	Not reported	`18.4`	fixed
Alpine	postgresql15	3.20	`15.18-r0`	fixed
Alpine	postgresql16	3.20	`16.14-r0`	fixed
Alpine	postgresql16	3.21	`16.14-r0`	fixed
Alpine	postgresql16	3.22	`16.14-r0`	fixed
Alpine	postgresql17	3.21	`17.10-r0`	fixed
Alpine	postgresql17	3.22	`17.10-r0`	fixed
Alpine	postgresql17	3.23	`17.10-r0`	fixed
Alpine	postgresql17	3.24	`17.10-r0`	fixed
Alpine	postgresql18	3.23	`18.4-r0`	fixed
Alpine	postgresql18	3.24	`18.4-r0`	fixed
Ubuntu	postgresql-9.3	pro	`9.3.1-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1ubuntu1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1bzr1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1bzr2`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.4-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.6-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.7-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.8-0ubuntu0.4.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.9-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.10-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.11-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.12-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.13-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.14-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.15-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.16-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.17-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.18-0ubuntu0.14.04.1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.19-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.20-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.21-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.22-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.23-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.24-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.24-0ubuntu0.14.04+esm1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-2`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-3`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.1-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.2-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.3-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.4-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.5-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.6-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.7-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.8-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.9-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.10-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.11-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.12-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.13-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.14-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.16-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.17-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.18-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.19-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.21-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.23-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.24-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm2`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm3`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm4`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm5`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm6`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm7`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm8`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm10`	vulnerable
Ubuntu	postgresql-10	pro	`10.1-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.1-2`	vulnerable
Ubuntu	postgresql-10	pro	`10.2-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.3-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.4-0ubuntu0.18.04`	vulnerable
Ubuntu	postgresql-10	pro	`10.5-0ubuntu0.18.04`	vulnerable
Ubuntu	postgresql-10	pro	`10.6-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.7-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.8-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.9-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.10-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.12-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.14-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.15-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.16-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.17-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.18-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.19-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.20-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.21-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.22-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm2`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm3`	vulnerable
Ubuntu	postgresql-12	20.04	`12.0-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.1-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.1-2build1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-4`	vulnerable
Ubuntu	postgresql-12	20.04	`12.4-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.5-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.6-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.7-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.8-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.9-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.10-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.11-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.12-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.13-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.14-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.15-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.16-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.17-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.18-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.19-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.20-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.2`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.4`	vulnerable
Ubuntu	postgresql-14	22.04	`14.1-1ubuntu1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.2-1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.2-1ubuntu1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.3-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.4-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.5-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.6-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.7-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.8-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.9-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.10-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.11-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.12-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.13-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.15-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.17-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.18-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.19-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.20-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.22-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.23-0ubuntu0.22.04.1`	fixed
Ubuntu	postgresql-16	24.04	`16.0-2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1build1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1build3`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu3`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu4`	vulnerable
Ubuntu	postgresql-16	24.04	`16.3-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.4-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.4-0ubuntu0.24.04.2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.6-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.8-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.9-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.10-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.11-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.14-0ubuntu0.24.04.1`	fixed
Ubuntu	postgresql-17	25.10	`17.4-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.4-2`	vulnerable
Ubuntu	postgresql-17	25.10	`17.5-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.5-1build1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.6-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.6-1build1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.7-0ubuntu0.25.10.1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.9-0ubuntu0.25.10.1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.10-0ubuntu0.25.10.1`	fixed
Ubuntu	postgresql-18	26.04	`18.0-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1ubuntu1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1ubuntu2`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-2`	vulnerable
Ubuntu	postgresql-18	26.04	`18.3-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.4-0ubuntu0.26.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	postgresql-15	source	bookworm	`15.18-0+deb12u1`	not yet assigned	Not reported	Not reported
Cpe	postgresql-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg-compat3	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg-dev	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg6	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpgtypes3	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpq-dev	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpq5	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-client-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-doc-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-plperl-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-plpython3-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-pltcl-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-server-dev-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`14.23`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`15.18`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`16.14`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`17.10`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`18.4`	Not reported	Not reported	Not reported
Alpine	postgresql15	apk	3.20	`15.18-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql16	apk	3.20	`16.14-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql16	apk	3.21	`16.14-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql16	apk	3.22	`16.14-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql17	apk	3.21	`17.10-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql17	apk	3.22	`17.10-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql17	apk	3.23	`17.10-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql17	apk	3.24	`17.10-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql18	apk	3.23	`18.4-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Alpine	postgresql18	apk	3.24	`18.4-r0`	Not reported	ALPINE-CVE-2026-6475	Not reported
Ubuntu	postgresql-14	deb	22.04	`14.23-0ubuntu0.22.04.1`	Not reported	UBUNTU-CVE-2026-6475	Not reported
Ubuntu	postgresql-16	deb	24.04	`16.14-0ubuntu0.24.04.1`	Not reported	UBUNTU-CVE-2026-6475	Not reported
Ubuntu	postgresql-17	deb	25.10	`17.10-0ubuntu0.25.10.1`	Not reported	UBUNTU-CVE-2026-6475	Not reported
Ubuntu	postgresql-18	deb	26.04	`18.4-0ubuntu0.26.04.1`	Not reported	UBUNTU-CVE-2026-6475	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libecpg6]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[libecpg-compat3]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[libecpg-dev]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[libpgtypes3]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[libpq5]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[libpq-dev]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-15]Fixed
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-client-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-doc-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · all · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · all · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · all · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-plperl-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-plpython3-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-pltcl-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
[postgresql-server-dev-15]Fixed
Source package: [postgresql-15]
Details (4)
- 15.18-0+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.18-0+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12
- 15.19-0+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 15.18-0+deb12u1
  nvd · postgresql-15 · debian · bookworm; nvd · postgresql-15 · debian · 12

[Debian 13 (Trixie)]

[libecpg6]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libecpg-compat3]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libecpg-dev]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpgtypes3]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpq5]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpq-dev]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-17]Fixed
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13

Next results

Observed: Oct 27, 2026, 7:34:38 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]