CVE catalog

CVE-2026-6575

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintaine

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.21% · Oct 25, 2026

A flaw was found in PostgreSQL. This buffer over-read vulnerability in the `pg_restore_attribute_stats()` function allows a table maintainer to infer memory values. By providing array values of unmatched length, a malicious table maintainer can cause query planning to read past the end of an array, leading to information disclosure. postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_restore_attribute_stats() The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpepostgresql-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpelibecpg-compat3Not reported16.14-0ubuntu0.24.04.1fixed
Cpelibecpg-devNot reported16.14-0ubuntu0.24.04.1fixed
Cpelibecpg6Not reported16.14-0ubuntu0.24.04.1fixed
Cpelibpgtypes3Not reported16.14-0ubuntu0.24.04.1fixed
Cpelibpq-devNot reported16.14-0ubuntu0.24.04.1fixed
Cpelibpq5Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-client-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-doc-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-plperl-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-plpython3-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-pltcl-16Not reported16.14-0ubuntu0.24.04.1fixed
Cpepostgresql-server-dev-16Not reported16.14-0ubuntu0.24.04.1fixed
CpepostgresqlNot reported18.4fixed
Debianpostgresql-181418.0-1vulnerable
Debianpostgresql-181418.1-1vulnerable
Debianpostgresql-181418.1-2vulnerable
Debianpostgresql-181418.2-1vulnerable
Debianpostgresql-181418.3-1vulnerable
Debianpostgresql-181418~beta1+20250612-1vulnerable
Debianpostgresql-181418~beta1+20250624-1vulnerable
Debianpostgresql-181418~beta1+20250701-1vulnerable
Debianpostgresql-181418~beta1-1vulnerable
Debianpostgresql-181418~beta2-1vulnerable
Debianpostgresql-181418~beta3-1vulnerable
Debianpostgresql-181418~rc1-1vulnerable
Debianpostgresql-181418~rc1-2vulnerable
Debianpostgresql-181418~rc1-3vulnerable
Debianpostgresql-181418~~devel.20250318+g4078da6c478-1vulnerable
Debianpostgresql-181418~~devel.20250331-1vulnerable
Debianpostgresql-181418~~devel.20250405-1vulnerable
Debianpostgresql-181418~~devel.20250421-1vulnerable
Debianpostgresql-181418~~devel.20250502-1vulnerable
Debianpostgresql-181418.4-1fixed
Alpinepostgresql183.2318.4-r0fixed
Alpinepostgresql183.2418.4-r0fixed
Ubuntupostgresql-9.3pro9.3.1-1vulnerable
Ubuntupostgresql-9.3pro9.3.2-1vulnerable
Ubuntupostgresql-9.3pro9.3.2-1ubuntu1vulnerable
Ubuntupostgresql-9.3pro9.3.2-1ubuntu2vulnerable
Ubuntupostgresql-9.3pro9.3.3-1vulnerable
Ubuntupostgresql-9.3pro9.3.3-1bzr1vulnerable
Ubuntupostgresql-9.3pro9.3.3-1bzr2vulnerable
Ubuntupostgresql-9.3pro9.3.4-1vulnerable
Ubuntupostgresql-9.3pro9.3.5-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.3pro9.3.6-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.7-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.8-0ubuntu0.4.04vulnerable
Ubuntupostgresql-9.3pro9.3.9-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.10-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.11-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.12-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.13-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.14-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.15-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.16-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.17-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.18-0ubuntu0.14.04.1vulnerable
Ubuntupostgresql-9.3pro9.3.19-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.20-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.21-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.22-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.23-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.24-0ubuntu0.14.04vulnerable
Ubuntupostgresql-9.3pro9.3.24-0ubuntu0.14.04+esm1vulnerable
Ubuntupostgresql-9.5pro9.5.0-1vulnerable
Ubuntupostgresql-9.5pro9.5.0-2vulnerable
Ubuntupostgresql-9.5pro9.5.0-3vulnerable
Ubuntupostgresql-9.5pro9.5.1-1vulnerable
Ubuntupostgresql-9.5pro9.5.2-1vulnerable
Ubuntupostgresql-9.5pro9.5.3-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.4-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.5-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.6-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.7-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.8-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.9-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.10-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.11-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.12-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.13-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.14-0ubuntu0.16.04vulnerable
Ubuntupostgresql-9.5pro9.5.16-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.17-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.18-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.19-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.21-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.23-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.24-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm1vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm2vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm3vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm4vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm5vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm6vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm7vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm8vulnerable
Ubuntupostgresql-9.5pro9.5.25-0ubuntu0.16.04.1+esm10vulnerable
Ubuntupostgresql-10pro10.1-1vulnerable
Ubuntupostgresql-10pro10.1-2vulnerable
Ubuntupostgresql-10pro10.2-1vulnerable
Ubuntupostgresql-10pro10.3-1vulnerable
Ubuntupostgresql-10pro10.4-0ubuntu0.18.04vulnerable
Ubuntupostgresql-10pro10.5-0ubuntu0.18.04vulnerable
Ubuntupostgresql-10pro10.6-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.7-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.8-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.9-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.10-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.12-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.14-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.15-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.16-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.17-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.18-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.19-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.20-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.21-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.22-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.23-0ubuntu0.18.04.1vulnerable
Ubuntupostgresql-10pro10.23-0ubuntu0.18.04.2vulnerable
Ubuntupostgresql-10pro10.23-0ubuntu0.18.04.2+esm1vulnerable
Ubuntupostgresql-10pro10.23-0ubuntu0.18.04.2+esm2vulnerable
Ubuntupostgresql-10pro10.23-0ubuntu0.18.04.2+esm3vulnerable
Ubuntupostgresql-1220.0412.0-1vulnerable
Ubuntupostgresql-1220.0412.1-1vulnerable
Ubuntupostgresql-1220.0412.1-2build1vulnerable
Ubuntupostgresql-1220.0412.2-1vulnerable
Ubuntupostgresql-1220.0412.2-1ubuntu2vulnerable
Ubuntupostgresql-1220.0412.2-4vulnerable
Ubuntupostgresql-1220.0412.4-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.5-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.6-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.7-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.8-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.9-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.10-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.11-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.12-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.13-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.14-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.15-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.16-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.17-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.18-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.19-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.20-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.22-0ubuntu0.20.04.1vulnerable
Ubuntupostgresql-1220.0412.22-0ubuntu0.20.04.2vulnerable
Ubuntupostgresql-1220.0412.22-0ubuntu0.20.04.4vulnerable
Ubuntupostgresql-1422.0414.1-1ubuntu1vulnerable
Ubuntupostgresql-1422.0414.2-1vulnerable
Ubuntupostgresql-1422.0414.2-1ubuntu1vulnerable
Ubuntupostgresql-1422.0414.3-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.4-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.5-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.6-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.7-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.8-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.9-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.10-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.11-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.12-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.13-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.15-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.17-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.18-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.19-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.20-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.22-0ubuntu0.22.04.1vulnerable
Ubuntupostgresql-1422.0414.23-0ubuntu0.22.04.1fixed
Ubuntupostgresql-1624.0416.0-2vulnerable
Ubuntupostgresql-1624.0416.1-1vulnerable
Ubuntupostgresql-1624.0416.1-1build1vulnerable
Ubuntupostgresql-1624.0416.1-1build3vulnerable
Ubuntupostgresql-1624.0416.2-1vulnerable
Ubuntupostgresql-1624.0416.2-1ubuntu2vulnerable
Ubuntupostgresql-1624.0416.2-1ubuntu3vulnerable
Ubuntupostgresql-1624.0416.2-1ubuntu4vulnerable
Ubuntupostgresql-1624.0416.3-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.4-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.4-0ubuntu0.24.04.2vulnerable
Ubuntupostgresql-1624.0416.6-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.8-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.9-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.10-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.11-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.13-0ubuntu0.24.04.1vulnerable
Ubuntupostgresql-1624.0416.14-0ubuntu0.24.04.1fixed
Ubuntupostgresql-1725.1017.4-1vulnerable
Ubuntupostgresql-1725.1017.4-2vulnerable
Ubuntupostgresql-1725.1017.5-1vulnerable
Ubuntupostgresql-1725.1017.5-1build1vulnerable
Ubuntupostgresql-1725.1017.6-1vulnerable
Ubuntupostgresql-1725.1017.6-1build1vulnerable
Ubuntupostgresql-1725.1017.7-0ubuntu0.25.10.1vulnerable
Ubuntupostgresql-1725.1017.9-0ubuntu0.25.10.1vulnerable
Ubuntupostgresql-1725.1017.10-0ubuntu0.25.10.1fixed
Ubuntupostgresql-1826.0418.0-1vulnerable
Ubuntupostgresql-1826.0418.1-1vulnerable
Ubuntupostgresql-1826.0418.1-1ubuntu1vulnerable
Ubuntupostgresql-1826.0418.1-1ubuntu2vulnerable
Ubuntupostgresql-1826.0418.1-2vulnerable
Ubuntupostgresql-1826.0418.3-1vulnerable
Ubuntupostgresql-1826.0418.4-0ubuntu0.26.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpepostgresql-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibecpg-compat3cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibecpg-devcpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibecpg6cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibpgtypes3cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibpq-devcpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpelibpq5cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-client-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-doc-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-plperl-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-plpython3-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-pltcl-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
Cpepostgresql-server-dev-16cpeNot reported16.14-0ubuntu0.24.04.1Not reportedNot reportedNot reported
CpepostgresqlcpeNot reported18.4Not reportedNot reportedNot reported
Debianpostgresql-18deb1418.4-1Not reportedDEBIAN-CVE-2026-6575Not reported
Alpinepostgresql18apk3.2318.4-r0Not reportedALPINE-CVE-2026-6575Not reported
Alpinepostgresql18apk3.2418.4-r0Not reportedALPINE-CVE-2026-6575Not reported
Ubuntupostgresql-14deb22.0414.23-0ubuntu0.22.04.1Not reportedUBUNTU-CVE-2026-6575Not reported
Ubuntupostgresql-16deb24.0416.14-0ubuntu0.24.04.1Not reportedUBUNTU-CVE-2026-6575Not reported
Ubuntupostgresql-17deb25.1017.10-0ubuntu0.25.10.1Not reportedUBUNTU-CVE-2026-6575Not reported
Ubuntupostgresql-18deb26.0418.4-0ubuntu0.26.04.1Not reportedUBUNTU-CVE-2026-6575Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References