CVE-2026-2007

postgresql18: This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixe...

CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High.

High
CVSS
8.8
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0055
45th percentile

This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory (bsc#1258008). - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code execution (bsc#1258009). - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary code execution (bsc#1258010). - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution (bsc#1258011). - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012). Regression fixes: - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values if the source of that value is a database column (caused by CVE-2026-2006 fix). - a standby may halt and return an error 'could not access status of transaction'.

Where it's fixed

ProductFixed inFixReleased
Linux
postgresql-18 · Debian 14 18.2-1 DEBIAN-CVE-2026-2007 Feb 12, 2026
postgresql18 · RHEL 10 18.3-1.el10_2 RHSA-2026:19009 Feb 12, 2026
postgresql18 · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18 · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18 · opensuse-leap 15.6 18.3-150600.13.8.1 SUSE-SU-2026:0881-1 Mar 12, 2026
postgresql18 · opensuse-leap 16.0 18.3-160000.1.1 OPENSUSE-SU-2026:20408-1 Mar 20, 2026
postgresql18 · rocky 10 0:18.3-1.el10 RLSA-2026:19009 May 29, 2026
postgresql18 · sles 15.6 18.3-150600.13.8.1 SUSE-SU-2026:0881-1 Mar 12, 2026
postgresql18 · sles 15.7 18.3-150600.13.8.1 SUSE-SU-2026:0881-1 Mar 12, 2026
postgresql18 · sles 16.0 18.3-160000.1.1 SUSE-SU-2026:20921-1 Mar 20, 2026
postgresql18-contrib · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-contrib · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-docs · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-docs · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-mini · opensuse-leap 16.0 18.3-160000.1.1 OPENSUSE-SU-2026:20408-1 Mar 20, 2026
postgresql18-plperl · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-plperl · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-plpython3 · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-plpython3 · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-private-devel · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-private-devel · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-private-libs · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-private-libs · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-server · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-server · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-server-devel · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-server-devel · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-static · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-static · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-test · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-test · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-test-rpm-macros · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-test-rpm-macros · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-upgrade · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-upgrade · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026
postgresql18-upgrade-devel · almalinux 10 18.3-1.el10_2 ALSA-2026:19009 May 19, 2026
postgresql18-upgrade-devel · ol 10 0:18.3-1.0.1.el10_2 ELSA-2026-19009 Jul 8, 2026