postgresql18: This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixe...
CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High.
This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory (bsc#1258008). - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code execution (bsc#1258009). - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary code execution (bsc#1258010). - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution (bsc#1258011). - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012). Regression fixes: - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values if the source of that value is a database column (caused by CVE-2026-2006 fix). - a standby may halt and return an error 'could not access status of transaction'.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| postgresql-18 · Debian 14 | 18.2-1 | DEBIAN-CVE-2026-2007 | Feb 12, 2026 |
| postgresql18 · RHEL 10 | 18.3-1.el10_2 | RHSA-2026:19009 | Feb 12, 2026 |
| postgresql18 · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18 · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18 · opensuse-leap 15.6 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · opensuse-leap 16.0 | 18.3-160000.1.1 | OPENSUSE-SU-2026:20408-1 | Mar 20, 2026 |
| postgresql18 · rocky 10 | 0:18.3-1.el10 | RLSA-2026:19009 | May 29, 2026 |
| postgresql18 · sles 15.6 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · sles 15.7 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · sles 16.0 | 18.3-160000.1.1 | SUSE-SU-2026:20921-1 | Mar 20, 2026 |
| postgresql18-contrib · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-contrib · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-docs · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-docs · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-mini · opensuse-leap 16.0 | 18.3-160000.1.1 | OPENSUSE-SU-2026:20408-1 | Mar 20, 2026 |
| postgresql18-plperl · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-plperl · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-plpython3 · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-plpython3 · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-private-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-private-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-private-libs · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-private-libs · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-server · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-server · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-server-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-server-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-static · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-static · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-test · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-test · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-test-rpm-macros · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-test-rpm-macros · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-upgrade · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-upgrade · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-upgrade-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-upgrade-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |