SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql18Upgrade postgresql17Upgrade postgresql16 | May 15, 2026 | May 14, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql16-docs-debuginfoUpgrade postgresql16-plperl-debuginfoUpgrade postgresql16-staticUpgrade postgresql16-upgrade-develUpgrade postgresql18-plpython3Upgrade postgresql18-serverUpgrade postgresql16-pltclUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql16-test-debuginfoUpgrade postgresql17-test-rpm-macrosUpgrade postgresql18-docsUpgrade postgresql16-llvmjitUpgrade postgresql17-llvmjitUpgrade postgresql17-upgrade-develUpgrade postgresql18-contrib-debuginfoUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-test-rpm-macrosUpgrade postgresql18-plperlUpgrade postgresql17-plperlUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql18-server-debuginfoUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql18-plperl-debuginfoUpgrade postgresql16-server-develUpgrade postgresql18-private-libsUpgrade postgresql17-private-libsUpgrade postgresql18-upgradeUpgrade postgresql18-test-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql17-server-develUpgrade postgresql18-private-develUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql17-docsUpgrade postgresql17-contrib-debuginfoUpgrade postgresql18-test-rpm-macrosUpgrade postgresql17-serverUpgrade postgresql17-debugsourceUpgrade postgresql16-docsUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql18Upgrade postgresql17-plpython3Upgrade postgresql17-plperl-debuginfoUpgrade postgresql17-private-develUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql17-test-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql18-pltcl-debuginfoUpgrade postgresql17-contribUpgrade postgresql17-debuginfoUpgrade postgresql18-debuginfoUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql16-serverUpgrade postgresql16-debugsourceUpgrade postgresql18-debugsourceUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql18-contribUpgrade postgresql16Upgrade postgresql18-staticUpgrade postgresql18-pltclUpgrade postgresql16-plpython3Upgrade postgresql16-contrib-debuginfoUpgrade postgresql16-testUpgrade postgresql18-llvmjitUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql18-server-develUpgrade postgresql16-private-develUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql17-server-debuginfoUpgrade postgresql17-docs-debuginfoUpgrade postgresql16-upgradeUpgrade postgresql17Upgrade postgresql16-contribUpgrade postgresql18-testUpgrade postgresql17-testUpgrade postgresql17-pltclUpgrade postgresql16-plperlUpgrade postgresql18-docs-debuginfoUpgrade postgresql17-upgradeUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql18-plpython3-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql17-staticUpgrade postgresql16-private-libsUpgrade postgresql18-upgrade-devel-debuginfoUpgrade postgresql18-llvmjit-debuginfo | Jun 9, 2026 | May 14, 2026 |
| Debian | — | Upgrade postgresql-17 | Jul 23, 2026 | Jul 23, 2026 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Postgres | — | Upgrade to PostgreSQL version 18.4Upgrade to PostgreSQL version 16.14Upgrade to PostgreSQL version 17.10 | May 14, 2026 | May 14, 2026 |
| Redhat_linux | — | Upgrade postgresql-upgrade-debuginfoUpgrade postgis-client-debuginfoUpgrade postgis-debugsourceUpgrade postgresql-contribUpgrade postgis-clientUpgrade postgis-upgrade-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql18-private-libsUpgrade postgresql18-serverUpgrade postgis-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql18-server-develUpgrade pgaudit-debugsourceUpgrade postgresql-serverUpgrade postgresql18-debugsourceUpgrade postgresql-docsUpgrade postgresql18-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql18-upgrade-devel-debuginfoUpgrade pgvectorUpgrade postgresql-plperlUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgis-utilsUpgrade postgresql-test-rpm-macrosUpgrade postgresql18-server-devel-debuginfoUpgrade postgresql18-docs-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-pltclUpgrade pg_repackUpgrade postgresql18-testUpgrade postgis-docsUpgrade postgresql-server-develUpgrade postgresql18-staticUpgrade postgresql-plpython3Upgrade pg_repack-debugsourceUpgrade postgresql18-upgrade-debuginfoUpgrade postgresql18Upgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-server-devel-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql18-private-develUpgrade postgis-upgradeUpgrade postgresql-debugsourceUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql18-upgrade-develUpgrade postgresql18-private-libs-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-upgradeUpgrade postgresql18-docsUpgrade postgresql-staticUpgrade postgresql16-debuginfoUpgrade postgres-decoderbufsUpgrade postgisUpgrade postgresql18-plperlUpgrade postgresql18-upgradeUpgrade postgresql-test-debuginfoUpgrade pgauditUpgrade postgresql-testUpgrade postgresql-private-libsUpgrade pgvector-debuginfoUpgrade postgresql-pltcl-debuginfo | Jul 17, 2026 | May 14, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.9Upgrade Splunk Enterprise to version 10.4.2Upgrade Splunk Enterprise to version 9.4.14Upgrade Splunk Enterprise to version 10.2.6 | Aug 20, 2026 | May 14, 2026 |
| Ubuntu | — | Upgrade postgresql-14Upgrade postgresql-16Upgrade postgresql-18Upgrade postgresql-17 | May 25, 2026 | May 21, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 19, 2026 | May 14, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub