Linux · 
openSUSE Leap · Security advisory · August 30, 2026
openSUSE Leap · Security advisory · August 30, 2026OPENSUSE-SU-2026:21702-1: postgresql17 security update
OPENSUSE-SU-2026:21702-1, released August 30, 2026, fixes 25 CVEs in postgresql17 (version 17.11-160000.1.1). None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
25
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile
Priority of the 25 CVEs
Patch now 0
Urgent 0
High 16
Routine 9
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| postgresql17 | opensuse-leap 16.0 | 17.11-160000.1.1 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-16239 | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | None reported |
| High | CVE-2026-14669 | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 | None reported |
| High | CVE-2026-15742 | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | None reported |
| High | CVE-2026-6471 | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | None reported |
| High | CVE-2026-14662 | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | None reported |
| High | CVE-2026-14664 | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-14670 | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-15741 | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 | None reported |
| High | CVE-2026-19385 | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | None reported |
| High | CVE-2026-14671 | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14680 | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14677 | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | None reported |
| High | CVE-2026-6464 | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | None reported |
| High | CVE-2026-18408 | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 | None reported |
| High | CVE-2026-14668 | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | None reported |
| High | CVE-2026-14679 | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 | None reported |
| Routine | CVE-2026-14672 | PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle | 5.3 | 0.0039 | None reported |
| Routine | CVE-2026-16241 | postgresql-15: Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service ag... | 3.8 | 0.0034 | None reported |
| Routine | CVE-2026-6470 | PostgreSQL fails to check type USAGE privilege | 4.3 | 0.0033 | None reported |
| Routine | CVE-2026-6469 | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership | 3.8 | 0.0032 | None reported |
| Routine | CVE-2026-14678 | PostgreSQL pg_trgm picksplit reads past end of buffer | 4.3 | 0.0030 | None reported |
| Routine | CVE-2026-18024 | PostgreSQL ascii() function reads past end of buffer | 4.3 | 0.0030 | None reported |
| Routine | CVE-2026-14666 | PostgreSQL row security caching disregards role modifications | 4.2 | 0.0021 | None reported |
| Routine | CVE-2026-14663 | PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext | 6.5 | 0.0011 | None reported |
| Routine | CVE-2026-14681 | postgresql-17: Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to... | 4.2 | 0.0008 | None reported |
Showing 1 to 25 of 25
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.