{
  "cveId": "CVE-2026-2007",
  "url": "https://patchblox.com/security/cve/CVE-2026-2007",
  "summary": "CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "postgresql18: This update for postgresql18 fixes the following issues:\n\nUpdate to version 18.3 (bsc#1258754).\n\nSecurity issues fixe...",
  "description": "This update for postgresql18 fixes the following issues:\n\nUpdate to version 18.3 (bsc#1258754).\n\nSecurity issues fixed:\n\n- CVE-2026-2003: improper validation of type \u0027oidvector\u0027 may allow disclose a few bytes of server memory (bsc#1258008).\n- CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code\n  execution (bsc#1258009).\n- CVE-2026-2005: buffer overrun in contrib/pgcrypto\u0027s PGP decryption functions could lead to arbitrary code execution\n  (bsc#1258010).\n- CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution\n  (bsc#1258011).\n- CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).\n    \nRegression fixes:\n\n  - the substring() function raises an error \u0027invalid byte sequence for encoding\u0027 on non-ASCII text values if the\n    source of that value is a database column (caused by CVE-2026-2006 fix).\n  - a standby may halt and return an error \u0027could not access status of transaction\u0027.",
  "published": "2026-02-12T13:00:11Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00546,
  "epssPercentile": 0.45945,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "postgresql-18",
      "release": "Debian 14",
      "fixedVersion": "18.2-1",
      "fix": "DEBIAN-CVE-2026-2007",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-2007",
      "released": "2026-02-12T14:16:02Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "RHEL 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "RHSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-19009",
      "released": "2026-02-12T13:00:11Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "18.3-150600.13.8.1",
      "fix": "SUSE-SU-2026:0881-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0881-1",
      "released": "2026-03-12T10:18:52Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "18.3-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20408-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20408-1",
      "released": "2026-03-20T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "rocky 10",
      "fixedVersion": "0:18.3-1.el10",
      "fix": "RLSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-19009",
      "released": "2026-05-29T16:03:24Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "sles 15.6",
      "fixedVersion": "18.3-150600.13.8.1",
      "fix": "SUSE-SU-2026:0881-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0881-1",
      "released": "2026-03-12T10:18:52Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "sles 15.7",
      "fixedVersion": "18.3-150600.13.8.1",
      "fix": "SUSE-SU-2026:0881-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-0881-1",
      "released": "2026-03-12T10:18:52Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18",
      "release": "sles 16.0",
      "fixedVersion": "18.3-160000.1.1",
      "fix": "SUSE-SU-2026:20921-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2026-20921-1",
      "released": "2026-03-20T14:50:46Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-contrib",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-contrib",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-docs",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-docs",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-mini",
      "release": "opensuse-leap 16.0",
      "fixedVersion": "18.3-160000.1.1",
      "fix": "OPENSUSE-SU-2026:20408-1",
      "url": "https://patchblox.com/security/fix/linux/opensuse-su-2026-20408-1",
      "released": "2026-03-20T14:50:43Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-plperl",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-plperl",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-plpython3",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-plpython3",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-private-devel",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-private-devel",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-private-libs",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-private-libs",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-server",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-server",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-server-devel",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-server-devel",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-static",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-static",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-test",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-test",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-test-rpm-macros",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-test-rpm-macros",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-upgrade",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-upgrade",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-upgrade-devel",
      "release": "almalinux 10",
      "fixedVersion": "18.3-1.el10_2",
      "fix": "ALSA-2026:19009",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-19009",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "postgresql18-upgrade-devel",
      "release": "ol 10",
      "fixedVersion": "0:18.3-1.0.1.el10_2",
      "fix": "ELSA-2026-19009",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-19009",
      "released": "2026-07-08T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T12:40:37Z"
}