# CVE-2026-2007: postgresql18: This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixe... CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-2007 - Priority: High - CVSS: 8.8 (high) - EPSS: 0.0055 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 12, 2026 ## Description This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory (bsc#1258008). - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code execution (bsc#1258009). - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary code execution (bsc#1258010). - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution (bsc#1258011). - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012). Regression fixes: - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values if the source of that value is a database column (caused by CVE-2026-2006 fix). - a standby may halt and return an error 'could not access status of transaction'. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | postgresql-18 Debian 14 | 18.2-1 | [DEBIAN-CVE-2026-2007](https://patchblox.com/security/data/fix/linux/debian-cve-2026-2007.md) | Feb 12, 2026 | | Linux | postgresql18 RHEL 10 | 18.3-1.el10_2 | [RHSA-2026:19009](https://patchblox.com/security/data/fix/linux/rhsa-2026-19009.md) | Feb 12, 2026 | | Linux | postgresql18 almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18 ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18 opensuse-leap 15.6 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 opensuse-leap 16.0 | 18.3-160000.1.1 | [OPENSUSE-SU-2026:20408-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20408-1.md) | Mar 20, 2026 | | Linux | postgresql18 rocky 10 | 0:18.3-1.el10 | [RLSA-2026:19009](https://patchblox.com/security/data/fix/linux/rlsa-2026-19009.md) | May 29, 2026 | | Linux | postgresql18 sles 15.6 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 sles 15.7 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 sles 16.0 | 18.3-160000.1.1 | [SUSE-SU-2026:20921-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20921-1.md) | Mar 20, 2026 | | Linux | postgresql18-contrib almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-contrib ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-docs almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-docs ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-mini opensuse-leap 16.0 | 18.3-160000.1.1 | [OPENSUSE-SU-2026:20408-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20408-1.md) | Mar 20, 2026 | | Linux | postgresql18-plperl almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-plperl ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-plpython3 almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-plpython3 ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-private-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-private-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-private-libs almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-private-libs ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-server almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-server ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-server-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-server-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-static almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-static ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-test almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-test ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-test-rpm-macros almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-test-rpm-macros ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-upgrade almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-upgrade ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-upgrade-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-upgrade-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | --- Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo