Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-upgradeUpgrade pgauditUpgrade postgresql-server-develUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade pgvectorUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-private-libsUpgrade postgresql-server | Sep 1, 2025 | Aug 28, 2025 |
| Alpine Linux | — | Upgrade postgresql16Upgrade postgresql15Upgrade postgresql17 | Aug 18, 2025 | Aug 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-staticUpgrade postgresql-test-rpm-macrosUpgrade postgresql-libsUpgrade postgresql-llvmjitUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-develUpgrade postgresql-docsUpgrade postgresql-plpythonUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-plperlUpgrade postgresql-upgrade-develUpgrade postgresql-plpython3Upgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql16-plpython3-debuginfoUpgrade postgresql15-contrib-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql17Upgrade postgresql17-contrib-debuginfoUpgrade postgresql17-docsUpgrade postgresql15-private-develUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-server-develUpgrade postgresql16-private-develUpgrade postgresql16-private-libsUpgrade postgresql17-private-libsUpgrade postgresql15-test-debuginfoUpgrade postgresql17-debugsourceUpgrade postgresql17-pltclUpgrade postgresql17-upgradeUpgrade postgresql15-contribUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql16-testUpgrade postgresql16-docsUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql15-test-rpm-macrosUpgrade postgresql17-plperlUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-testUpgrade postgresql16-plperl-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-debuginfoUpgrade postgresql17-test-rpm-macrosUpgrade postgresql17-upgrade-develUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql16-staticUpgrade postgresql17-llvmjitUpgrade postgresql15-upgradeUpgrade postgresql15Upgrade postgresql17-plpython3Upgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql17-server-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-serverUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-llvmjitUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql16-contribUpgrade postgresql16Upgrade postgresql17-test-debuginfoUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql16-pltclUpgrade postgresql15-server-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql15-pltclUpgrade postgresql17-debuginfoUpgrade postgresql17-testUpgrade postgresql16-serverUpgrade postgresql15-staticUpgrade postgresql15-serverUpgrade postgresql16-contrib-debuginfoUpgrade postgresql16-server-develUpgrade postgresql16-llvmjitUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql15-docsUpgrade postgresql17-plperl-debuginfoUpgrade postgresql15-upgrade-develUpgrade postgresql17-contribUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-test-rpm-macrosUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql17-private-develUpgrade postgresql15-server-develUpgrade postgresql16-plperlUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql17-staticUpgrade postgresql17-docs-debuginfoUpgrade postgresql15-plperlUpgrade postgresql16-upgrade-develUpgrade postgresql16-upgradeUpgrade postgresql16-test-debuginfoUpgrade postgresql16-plpython3Upgrade postgresql16-debugsourceUpgrade postgresql15-docs-debuginfoUpgrade postgresql16-upgrade-devel-debuginfo | Sep 9, 2025 | Aug 14, 2025 |
| Debian | — | Upgrade postgresql-17Upgrade postgresql-13Upgrade postgresql-15 | Aug 18, 2025 | Aug 18, 2025 |
| Freebsd | — | Upgrade postgresql17-serverUpgrade postgresql15-serverUpgrade postgresql16-serverUpgrade postgresql14-serverUpgrade postgresql13-server | Dec 10, 2025 | Aug 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Oracle_linux | — | Upgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresqlUpgrade pgvectorUpgrade postgresql-private-libsUpgrade postgresql-testUpgrade postgresql-upgrade-develUpgrade postgresql-test-rpm-macrosUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-plpython3Upgrade postgresql-develUpgrade postgres-decoderbufsUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-server-develUpgrade pgauditUpgrade postgresql-plpython | Sep 2, 2025 | Aug 14, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 17.6Upgrade to PostgreSQL version 16.10Upgrade to PostgreSQL version 14.19Upgrade to PostgreSQL version 15.14 | Aug 15, 2025 | Aug 14, 2025 |
| Redhat_linux | — | Upgrade pgauditUpgrade pgvector-debugsourceUpgrade postgresql-private-libsUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade pg_repack-debuginfoUpgrade postgresql-server-develUpgrade postgresql16-debuginfoNo solution existsUpgrade postgresql-plpython3-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql-testUpgrade postgresql-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufsUpgrade pg_repack-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgradeUpgrade postgresql-test-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-staticUpgrade postgresql-plpythonUpgrade postgresql-plperl-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql-private-develUpgrade postgresql-develUpgrade postgresql-libsUpgrade postgresql-pltclUpgrade postgresql-docsUpgrade postgresqlUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-plperlUpgrade pgvectorUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-contribUpgrade postgresql-upgrade-debuginfo | Sep 1, 2025 | Aug 14, 2025 |
| Rocky_linux | — | Upgrade postgresql-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufsUpgrade pgauditUpgrade postgresql-contribUpgrade postgresql-server-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-private-develUpgrade postgresql-serverUpgrade postgresql-plperlUpgrade postgresql-staticUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-docsUpgrade postgres-decoderbufs-debuginfoUpgrade pg_repack-debugsourceUpgrade pg_repackUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-upgradeUpgrade pgaudit-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-private-libsUpgrade postgresql-contrib-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade pgaudit-debuginfoUpgrade pgvectorUpgrade postgresql-plpython3Upgrade pgvector-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql16-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql-server-develUpgrade pg_repack-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql16-debugsource | Feb 5, 2026 | Sep 8, 2025 |
| Suse | — | Upgrade postgresql13-llvmjit-develUpgrade libecpg6Upgrade postgresql13-contribUpgrade postgresql17-contribUpgrade postgresql13-develUpgrade postgresql13-plpythonUpgrade postgresql16-plpythonUpgrade postgresql16-testUpgrade postgresql14-server-develUpgrade postgresql14-testUpgrade postgresql15-plperlUpgrade postgresql14-llvmjit-develUpgrade libecpg6-32bitUpgrade postgresql14Upgrade postgresql15-serverUpgrade libpq5Upgrade postgresql15-plpythonUpgrade postgresql14-docsUpgrade postgresql13-server-develUpgrade postgresql16-develUpgrade postgresql15-develUpgrade postgresql14-serverUpgrade postgresql13-pltclUpgrade postgresql15-docsUpgrade postgresql15-contribUpgrade postgresql17-plperlUpgrade postgresql17-testUpgrade postgresql15-server-develUpgrade postgresql15-testUpgrade postgresql17-server-develUpgrade postgresql14-pltclUpgrade postgresql16-pltclUpgrade postgresql16-serverUpgrade postgresql13Upgrade postgresql14-plpythonUpgrade libpq5-32bitUpgrade postgresql13-serverUpgrade postgresql17-pltclUpgrade postgresql16-llvmjitUpgrade postgresql16-contribUpgrade postgresql14-develUpgrade postgresql17-plpythonUpgrade postgresql15-llvmjit-develUpgrade postgresql14-llvmjitUpgrade postgresql16-docsUpgrade postgresql17Upgrade postgresql17-serverUpgrade postgresql17-llvmjitUpgrade postgresql17-develUpgrade postgresql16-server-develUpgrade postgresql16-plperlUpgrade postgresql15Upgrade postgresql13-docsUpgrade postgresql17-docsUpgrade postgresql16-llvmjit-develUpgrade postgresql16Upgrade postgresql15-llvmjitUpgrade postgresql14-contribUpgrade postgresql13-testUpgrade postgresql13-plperlUpgrade postgresql17-llvmjit-develUpgrade postgresql15-pltclUpgrade postgresql14-plperlUpgrade postgresql13-llvmjit | Dec 5, 2025 | Aug 29, 2025 |
| Ubuntu | — | Upgrade postgresql-14Upgrade postgresql-client-17Upgrade postgresql-18Upgrade postgresql-16Upgrade postgresql-client-16Upgrade postgresql-17Upgrade postgresql-client-14 | Sep 9, 2025 | Aug 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Aug 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub