Описание
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
A flaw was found in PostgreSQL. A heap buffer overflow vulnerability exists in the regexp component, which can be triggered by a query author providing text that does not pass encoding validation. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the operating system user running the database.
Отчет
This flaw is rated as Important. A heap buffer overflow in the PostgreSQL regular expression engine allows an authenticated query author to execute arbitrary code as the database operating system user. This can lead to a complete compromise of the database server through specially crafted input that bypasses encoding validation.
Меры по смягчению последствий
Restrict PostgreSQL to trusted hosts and bind only required interfaces. Do not grant CONNECT to untrusted roles; any session that can run SQL can call regexp_match / regexp_matches / regexp_split_to_*. If those functions are unused, REVOKE EXECUTE on them from PUBLIC.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | postgresql | Not affected | ||
| Red Hat Enterprise Linux 7 | postgresql | Not affected | ||
| Red Hat Hardened Images | postgresql17 | Not affected | ||
| Red Hat Hardened Images | postgresql18 | Not affected | ||
| Red Hat Enterprise Linux 10 | postgresql18 | Fixed | RHSA-2026:67280 | 14.09.2026 |
| Red Hat Enterprise Linux 10 | postgresql16 | Fixed | RHSA-2026:70186 | 22.09.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | postgresql16 | Fixed | RHSA-2026:72282 | 28.09.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69876 | 22.09.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69923 | 22.09.2026 |
| Red Hat Enterprise Linux 8 | postgresql | Fixed | RHSA-2026:69924 | 23.09.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
PostgreSQL regexp heap buffer overflow executes arbitrary code
Heap buffer overflow in PostgreSQL regexp allows the query author to e ...
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
EPSS
8.8 High
CVSS3