Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pg_repackUpgrade postgresql-plpython3Upgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-staticUpgrade postgresql-contribUpgrade pgauditUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-docsUpgrade postgresql-server-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-upgrade-develUpgrade pgvectorUpgrade postgresql-private-devel | Sep 1, 2025 | Aug 28, 2025 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql17Upgrade postgresql16 | Aug 18, 2025 | Aug 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-serverUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-llvmjitUpgrade postgresql-private-develUpgrade postgresql-develUpgrade postgresql-plpythonUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresql-plpython3Upgrade postgresql-debuginfoUpgrade postgresql-upgradeUpgrade postgresqlUpgrade postgresql-private-libs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-server-develUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql16Upgrade postgresql17-private-develUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql17-staticUpgrade postgresql15-plperlUpgrade postgresql17-contribUpgrade postgresql16-test-rpm-macrosUpgrade postgresql16-plperlUpgrade postgresql15-server-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql16-pltclUpgrade postgresql17-test-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql16-plpython3Upgrade postgresql16-upgrade-develUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql15-llvmjitUpgrade postgresql15-plpython3Upgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-docs-debuginfoUpgrade postgresql15-pltclUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql17-plperl-debuginfoUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql15-docsUpgrade postgresql16-test-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql16-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql16-contribUpgrade postgresql17-testUpgrade postgresql16-upgradeUpgrade postgresql15-serverUpgrade postgresql15-staticUpgrade postgresql16-server-develUpgrade postgresql17-debuginfoUpgrade postgresql16-serverUpgrade postgresql16-contrib-debuginfoUpgrade postgresql16-llvmjitUpgrade postgresql17-serverUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql17-server-develUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-plpython3Upgrade postgresql17-pltclUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql17-contrib-debuginfoUpgrade postgresql17Upgrade postgresql16-server-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql17-debugsourceUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql17-private-libsUpgrade postgresql17-test-rpm-macrosUpgrade postgresql16-docsUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql17-server-debuginfoUpgrade postgresql17-plperlUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-plperl-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-testUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql16-private-libsUpgrade postgresql16-private-develUpgrade postgresql15Upgrade postgresql15-contribUpgrade postgresql17-upgradeUpgrade postgresql16-staticUpgrade postgresql17-llvmjitUpgrade postgresql15-private-develUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql16-testUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql17-docsUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql17-upgrade-devel | Sep 9, 2025 | Aug 14, 2025 |
| Debian | — | Upgrade postgresql-17Upgrade postgresql-13Upgrade postgresql-15 | Aug 18, 2025 | Aug 18, 2025 |
| Freebsd | — | Upgrade postgresql14-serverUpgrade postgresql13-serverUpgrade postgresql16-serverUpgrade postgresql15-serverUpgrade postgresql17-server | Dec 10, 2025 | Aug 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Oracle_linux | — | Upgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-testUpgrade pgvectorUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-pltclUpgrade postgresql-libsUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-develUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade postgresql-plpythonUpgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade pgauditUpgrade postgresql-docsUpgrade postgresql-upgrade | Sep 2, 2025 | Aug 14, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 14.19Upgrade to PostgreSQL version 15.14Upgrade to PostgreSQL version 17.6Upgrade to PostgreSQL version 16.10 | Aug 15, 2025 | Aug 14, 2025 |
| Redhat_linux | — | Upgrade postgresql-serverUpgrade postgresql-develUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade pgvectorUpgrade postgresql-libsUpgrade postgresql16-debugsourceUpgrade pgaudit-debugsourceUpgrade postgresql-staticUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-docsUpgrade postgresql-contribUpgrade postgresql-plpythonUpgrade pg_repackUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperlUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-upgradeUpgrade pgvector-debugsourceUpgrade pg_repack-debugsourceUpgrade postgresql-plpython3Upgrade pgaudit-debuginfoUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-test-debuginfoNo solution existsUpgrade postgresql-plpython3-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-server-develUpgrade pg_repack-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade pgvector-debuginfo | Sep 1, 2025 | Aug 14, 2025 |
| Rocky_linux | — | Upgrade postgresql16-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-pltclUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade pgvector-debugsourceUpgrade postgresql16-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade pgvectorUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-debuginfoUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-private-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-contribUpgrade postgresql-staticUpgrade postgresql-plperl-debuginfo | Feb 5, 2026 | Sep 8, 2025 |
| Suse | — | Upgrade postgresql17-plperlUpgrade postgresql14-pltclUpgrade postgresql16-plpythonUpgrade postgresql17-server-develUpgrade postgresql17-contribUpgrade libpq5Upgrade libecpg6-32bitUpgrade postgresql14Upgrade libecpg6Upgrade postgresql15-plpythonUpgrade postgresql15-serverUpgrade postgresql13-llvmjit-develUpgrade postgresql15-testUpgrade postgresql14-testUpgrade postgresql15-plperlUpgrade postgresql15-docsUpgrade postgresql16-develUpgrade postgresql13-server-develUpgrade postgresql15-contribUpgrade postgresql15-server-develUpgrade postgresql16-pltclUpgrade postgresql13-plpythonUpgrade postgresql14-docsUpgrade postgresql15-develUpgrade postgresql13-contribUpgrade postgresql13-pltclUpgrade postgresql16-testUpgrade postgresql14-serverUpgrade postgresql17-testUpgrade postgresql14-llvmjit-develUpgrade postgresql13-develUpgrade postgresql14-server-develUpgrade postgresql17-llvmjitUpgrade postgresql17Upgrade postgresql17-develUpgrade postgresql13Upgrade postgresql13-llvmjitUpgrade postgresql16-serverUpgrade postgresql16-docsUpgrade postgresql14-plpythonUpgrade postgresql13-serverUpgrade postgresql16-llvmjitUpgrade postgresql16-contribUpgrade libpq5-32bitUpgrade postgresql17-pltclUpgrade postgresql17-plpythonUpgrade postgresql15-llvmjit-develUpgrade postgresql14-llvmjitUpgrade postgresql14-develUpgrade postgresql13-docsUpgrade postgresql17-llvmjit-develUpgrade postgresql16-plperlUpgrade postgresql16-server-develUpgrade postgresql15-pltclUpgrade postgresql15Upgrade postgresql14-plperlUpgrade postgresql17-serverUpgrade postgresql16-llvmjit-develUpgrade postgresql17-docsUpgrade postgresql16Upgrade postgresql15-llvmjitUpgrade postgresql14-contribUpgrade postgresql13-plperlUpgrade postgresql13-test | Dec 5, 2025 | Aug 29, 2025 |
| Ubuntu | — | Upgrade postgresql-17Upgrade postgresql-client-16Upgrade postgresql-client-14Upgrade postgresql-14Upgrade postgresql-18Upgrade postgresql-client-17Upgrade postgresql-16 | Sep 9, 2025 | Aug 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Aug 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub