Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql16Upgrade postgresql17Upgrade postgresql15Upgrade postgresql18 | Aug 17, 2026 | Aug 13, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql18-debuginfoUpgrade postgresql18-plpython3-debuginfoUpgrade postgresql18-contribUpgrade postgresql18-test-rpm-macrosUpgrade postgresql18-pltclUpgrade postgresql18-upgradeUpgrade postgresql18-contrib-debuginfoUpgrade postgresql18-plperlUpgrade postgresql18-llvmjitUpgrade postgresql18-private-develUpgrade postgresql18-private-libsUpgrade postgresql18-docsUpgrade postgresql18-staticUpgrade postgresql18-server-debuginfoUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql18-pltcl-debuginfoUpgrade postgresql18-docs-debuginfoUpgrade postgresql18-serverUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql18Upgrade postgresql18-llvmjit-debuginfoUpgrade postgresql18-server-develUpgrade postgresql18-debugsourceUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql18-plperl-debuginfoUpgrade postgresql18-test-debuginfoUpgrade postgresql18-testUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql18-plpython3 | Sep 1, 2026 | Aug 13, 2026 |
| Freebsd | — | Upgrade postgresql18-serverUpgrade postgresql17-serverUpgrade postgresql16-serverUpgrade postgresql15-serverUpgrade postgresql14-server | Aug 17, 2026 | Aug 16, 2026 |
| Postgres | — | Upgrade to PostgreSQL version 18.6 | Aug 14, 2026 | Aug 13, 2026 |
| Redhat_linux | — | Upgrade postgresql18-docsUpgrade postgresql-server-debuginfoUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql18-plpython3-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql18-debuginfoUpgrade postgresql-docsUpgrade postgis-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql18-serverUpgrade pg_repackUpgrade postgresql18-server-debuginfoUpgrade postgresql18-contribUpgrade postgresql-debuginfoUpgrade postgresql18-contrib-debuginfoUpgrade postgresql18-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgresql-upgrade-develUpgrade pgauditUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql18-plperlUpgrade postgresql18-staticUpgrade pg_repack-debugsourceUpgrade postgis-clientUpgrade postgresql18-private-libsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql-staticUpgrade postgis-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade postgresql18Upgrade postgis-client-debuginfoUpgrade postgisUpgrade postgresql18-test-debuginfoUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql18-test-rpm-macrosUpgrade postgis-docsUpgrade postgresql18-server-develUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-libsUpgrade postgis-utilsUpgrade postgresql18-plpython3Upgrade postgresql-contribUpgrade postgresql-plperlUpgrade postgresql-contrib-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql18-private-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade pgvectorUpgrade postgresql-pltclUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql18-pltcl-debuginfoUpgrade postgresql-server-develUpgrade postgresql18-debugsourceUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql18-plperl-debuginfoUpgrade postgresql18-docs-debuginfoUpgrade postgresql-testUpgrade postgis-upgradeUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debugsourceUpgrade postgis-upgrade-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql18-test | Aug 27, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade postgresql18-private-develUpgrade postgresql18-debuginfoUpgrade pg_repackUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-serverUpgrade postgis-client-debuginfoUpgrade postgresql18-private-libsUpgrade pgauditUpgrade postgresql-pltclUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql18-docsUpgrade postgresql18-server-debuginfoUpgrade postgresql18-contrib-debuginfoUpgrade postgresql-staticUpgrade postgresql18-plperlUpgrade postgis-upgrade-debuginfoUpgrade postgis-debugsourceUpgrade postgresql18-upgradeUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgis-debuginfoUpgrade postgresql-plperlUpgrade postgresql18-docs-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql18-staticUpgrade postgresql-upgrade-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql18-plpython3-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql18-server-develUpgrade postgis-clientUpgrade postgresql18-testUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-develUpgrade postgresql18-test-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql18-plperl-debuginfoUpgrade postgresql18-contribUpgrade postgresql-contrib-debuginfoUpgrade postgisUpgrade pgaudit-debugsourceUpgrade postgis-utilsUpgrade pgvectorUpgrade pg_repack-debugsourceUpgrade postgis-docsUpgrade postgresql-server-devel-debuginfoUpgrade postgresql18-serverUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql18Upgrade postgres-decoderbufs-debugsourceUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgis-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql18-debugsourceUpgrade postgresql-server-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql18-plpython3Upgrade postgresql-docs-debuginfoUpgrade pgvector-debugsource | Sep 17, 2026 | Sep 15, 2026 |
| Ubuntu | — | Upgrade postgresql-16Upgrade postgresql-14Upgrade postgresql-18 | Aug 20, 2026 | Aug 13, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub