CVE catalog

CVE-2026-6476

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next ru

[CVE catalog]

Severity: High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: May 14, 2026, 1:00:11 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.29% · Oct 25, 2026

A flaw was found in PostgreSQL. An attacker with `pg_create_subscription` rights can exploit a SQL injection vulnerability in the `pg_createsubscriber` utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when `pg_createsubscriber` is next run, leading to potential compromise of the database system. postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Cpe	postgresql-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg-compat3	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg-dev	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libecpg6	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpgtypes3	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpq-dev	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	libpq5	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-client-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-doc-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-plperl-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-plpython3-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-pltcl-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql-server-dev-16	Not reported	`16.14-0ubuntu0.24.04.1`	fixed
Cpe	postgresql	Not reported	`17.10`	fixed
Cpe	postgresql	Not reported	`18.4`	fixed
Debian	postgresql-17	13	`17.5-1`	vulnerable
Debian	postgresql-17	13	`17.6-0+deb13u1`	vulnerable
Debian	postgresql-17	13	`17.6-1`	vulnerable
Debian	postgresql-17	13	`17.7-0+deb13u1`	vulnerable
Debian	postgresql-17	13	`17.8-0+deb13u1`	vulnerable
Debian	postgresql-17	13	`17.9-0+deb13u1`	vulnerable
Debian	postgresql-17	13	`17.10-0+deb13u1`	fixed
Debian	postgresql-18	14	`18.0-1`	vulnerable
Debian	postgresql-18	14	`18.1-1`	vulnerable
Debian	postgresql-18	14	`18.1-2`	vulnerable
Debian	postgresql-18	14	`18.2-1`	vulnerable
Debian	postgresql-18	14	`18.3-1`	vulnerable
Debian	postgresql-18	14	`18~beta1+20250612-1`	vulnerable
Debian	postgresql-18	14	`18~beta1+20250624-1`	vulnerable
Debian	postgresql-18	14	`18~beta1+20250701-1`	vulnerable
Debian	postgresql-18	14	`18~beta1-1`	vulnerable
Debian	postgresql-18	14	`18~beta2-1`	vulnerable
Debian	postgresql-18	14	`18~beta3-1`	vulnerable
Debian	postgresql-18	14	`18~rc1-1`	vulnerable
Debian	postgresql-18	14	`18~rc1-2`	vulnerable
Debian	postgresql-18	14	`18~rc1-3`	vulnerable
Debian	postgresql-18	14	`18~~devel.20250318+g4078da6c478-1`	vulnerable
Debian	postgresql-18	14	`18~~devel.20250331-1`	vulnerable
Debian	postgresql-18	14	`18~~devel.20250405-1`	vulnerable
Debian	postgresql-18	14	`18~~devel.20250421-1`	vulnerable
Debian	postgresql-18	14	`18~~devel.20250502-1`	vulnerable
Debian	postgresql-18	14	`18.4-1`	fixed
Alpine	postgresql17	3.21	`17.10-r0`	fixed
Alpine	postgresql17	3.22	`17.10-r0`	fixed
Alpine	postgresql17	3.23	`17.10-r0`	fixed
Alpine	postgresql17	3.24	`17.10-r0`	fixed
Alpine	postgresql18	3.23	`18.4-r0`	fixed
Alpine	postgresql18	3.24	`18.4-r0`	fixed
Ubuntu	postgresql-9.3	pro	`9.3.1-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1ubuntu1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1bzr1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.3-1bzr2`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.4-1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.5-0ubuntu0.14.04.1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.6-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.7-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.8-0ubuntu0.4.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.9-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.10-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.11-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.12-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.13-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.14-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.15-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.16-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.17-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.18-0ubuntu0.14.04.1`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.19-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.20-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.21-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.22-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.23-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.24-0ubuntu0.14.04`	vulnerable
Ubuntu	postgresql-9.3	pro	`9.3.24-0ubuntu0.14.04+esm1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-2`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.0-3`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.1-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.2-1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.3-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.4-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.5-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.6-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.7-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.8-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.9-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.10-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.11-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.12-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.13-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.14-0ubuntu0.16.04`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.16-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.17-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.18-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.19-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.21-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.23-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.24-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm1`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm2`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm3`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm4`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm5`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm6`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm7`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm8`	vulnerable
Ubuntu	postgresql-9.5	pro	`9.5.25-0ubuntu0.16.04.1+esm10`	vulnerable
Ubuntu	postgresql-10	pro	`10.1-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.1-2`	vulnerable
Ubuntu	postgresql-10	pro	`10.2-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.3-1`	vulnerable
Ubuntu	postgresql-10	pro	`10.4-0ubuntu0.18.04`	vulnerable
Ubuntu	postgresql-10	pro	`10.5-0ubuntu0.18.04`	vulnerable
Ubuntu	postgresql-10	pro	`10.6-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.7-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.8-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.9-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.10-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.12-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.14-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.15-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.16-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.17-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.18-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.19-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.20-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.21-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.22-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm1`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm2`	vulnerable
Ubuntu	postgresql-10	pro	`10.23-0ubuntu0.18.04.2+esm3`	vulnerable
Ubuntu	postgresql-12	20.04	`12.0-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.1-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.1-2build1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-12	20.04	`12.2-4`	vulnerable
Ubuntu	postgresql-12	20.04	`12.4-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.5-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.6-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.7-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.8-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.9-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.10-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.11-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.12-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.13-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.14-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.15-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.16-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.17-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.18-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.19-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.20-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.1`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.2`	vulnerable
Ubuntu	postgresql-12	20.04	`12.22-0ubuntu0.20.04.4`	vulnerable
Ubuntu	postgresql-14	22.04	`14.1-1ubuntu1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.2-1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.2-1ubuntu1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.3-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.4-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.5-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.6-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.7-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.8-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.9-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.10-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.11-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.12-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.13-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.15-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.17-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.18-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.19-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.20-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.22-0ubuntu0.22.04.1`	vulnerable
Ubuntu	postgresql-14	22.04	`14.23-0ubuntu0.22.04.1`	fixed
Ubuntu	postgresql-16	24.04	`16.0-2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1build1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.1-1build3`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu3`	vulnerable
Ubuntu	postgresql-16	24.04	`16.2-1ubuntu4`	vulnerable
Ubuntu	postgresql-16	24.04	`16.3-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.4-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.4-0ubuntu0.24.04.2`	vulnerable
Ubuntu	postgresql-16	24.04	`16.6-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.8-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.9-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.10-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.11-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.13-0ubuntu0.24.04.1`	vulnerable
Ubuntu	postgresql-16	24.04	`16.14-0ubuntu0.24.04.1`	fixed
Ubuntu	postgresql-17	25.10	`17.4-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.4-2`	vulnerable
Ubuntu	postgresql-17	25.10	`17.5-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.5-1build1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.6-1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.6-1build1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.7-0ubuntu0.25.10.1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.9-0ubuntu0.25.10.1`	vulnerable
Ubuntu	postgresql-17	25.10	`17.10-0ubuntu0.25.10.1`	fixed
Ubuntu	postgresql-18	26.04	`18.0-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1ubuntu1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-1ubuntu2`	vulnerable
Ubuntu	postgresql-18	26.04	`18.1-2`	vulnerable
Ubuntu	postgresql-18	26.04	`18.3-1`	vulnerable
Ubuntu	postgresql-18	26.04	`18.4-0ubuntu0.26.04.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Cpe	postgresql-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg-compat3	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg-dev	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libecpg6	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpgtypes3	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpq-dev	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	libpq5	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-client-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-doc-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-plperl-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-plpython3-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-pltcl-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql-server-dev-16	cpe	Not reported	`16.14-0ubuntu0.24.04.1`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`17.10`	Not reported	Not reported	Not reported
Cpe	postgresql	cpe	Not reported	`18.4`	Not reported	Not reported	Not reported
Debian	postgresql-17	deb	13	`17.10-0+deb13u1`	Not reported	DEBIAN-CVE-2026-6476	Not reported
Debian	postgresql-18	deb	14	`18.4-1`	Not reported	DEBIAN-CVE-2026-6476	Not reported
Alpine	postgresql17	apk	3.21	`17.10-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Alpine	postgresql17	apk	3.22	`17.10-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Alpine	postgresql17	apk	3.23	`17.10-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Alpine	postgresql17	apk	3.24	`17.10-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Alpine	postgresql18	apk	3.23	`18.4-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Alpine	postgresql18	apk	3.24	`18.4-r0`	Not reported	ALPINE-CVE-2026-6476	Not reported
Ubuntu	postgresql-14	deb	22.04	`14.23-0ubuntu0.22.04.1`	Not reported	UBUNTU-CVE-2026-6476	Not reported
Ubuntu	postgresql-16	deb	24.04	`16.14-0ubuntu0.24.04.1`	Not reported	UBUNTU-CVE-2026-6476	Not reported
Ubuntu	postgresql-17	deb	25.10	`17.10-0ubuntu0.25.10.1`	Not reported	UBUNTU-CVE-2026-6476	Not reported
Ubuntu	postgresql-18	deb	26.04	`18.4-0ubuntu0.26.04.1`	Not reported	UBUNTU-CVE-2026-6476	Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

[libecpg6]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libecpg-compat3]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libecpg-dev]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpgtypes3]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpq5]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[libpq-dev]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-17]Fixed
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-client-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-doc-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · all · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · all · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · all · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · all · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-plperl-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-plpython3-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-pltcl-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
[postgresql-server-dev-17]Fixed
Source package: [postgresql-17]
Details (5)
- 17.10-0+deb13u1 · amd64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · arm64 · trixie
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.10-0+deb13u1 · amd64 · trixie-security · Historical version
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · amd64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13
- 17.11-0+deb13u1 · arm64 · trixie-security
  Fixed · Fixed: 17.10-0+deb13u1
  nvd · postgresql-17 · debian · 13

Observed: Oct 27, 2026, 7:34:38 AM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]