PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plpython3Upgrade pg_repackUpgrade postgis-utilsUpgrade pgvectorUpgrade postgresql-pltclUpgrade postgresql-upgradeUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgis-clientUpgrade postgresqlUpgrade postgresql-private-develUpgrade postgresql-upgrade-develUpgrade postgisUpgrade pgauditUpgrade postgis-upgradeUpgrade postgis-docsUpgrade postgresql-docsUpgrade postgresql-private-libsUpgrade postgresql-server | Oct 11, 2026 | Sep 15, 2026 |
| Redhat_linux | — | Upgrade postgresql-plpython3Upgrade postgresql18-postgis-docsUpgrade postgis-upgradeUpgrade postgresql-docs-debuginfoUpgrade postgresql18-postgis-client-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql18-postgis-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade pgvector-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade pg_repack-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-debugsourceUpgrade postgisUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgis-utilsUpgrade postgresql18-postgis-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgis-docsUpgrade pgaudit-debuginfoUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql16-postgis-debugsourceUpgrade postgis-clientUpgrade pgaudit-debugsourceUpgrade postgresql18-postgis-upgrade-debuginfoUpgrade postgresql18-postgis-utilsUpgrade postgresqlUpgrade postgis-debuginfoUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresql-plperl-debuginfoUpgrade postgresql-contribUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docsUpgrade pgvectorUpgrade postgis-client-debuginfoUpgrade postgresql18-postgis-upgradeUpgrade postgis-debugsourceUpgrade postgresql-test-rpm-macrosUpgrade postgis-upgrade-debuginfoUpgrade pgauditUpgrade pg_repackUpgrade postgresql-plperlUpgrade postgresql18-postgisUpgrade postgresql-test-debuginfoUpgrade postgresql-private-develUpgrade postgresql-upgrade-debuginfoUpgrade postgresql18-postgis-clientUpgrade postgresql-pltclUpgrade postgresql-server-debuginfoUpgrade postgresql-debuginfoUpgrade postgresql16-postgis-debuginfo | Aug 17, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade pg_repackUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade pgvectorUpgrade postgis-clientUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltclUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-serverUpgrade postgis-client-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-debuginfoUpgrade pgaudit-debugsourceUpgrade postgis-upgrade-debuginfoUpgrade pgvector-debuginfoUpgrade postgresql16-postgis-debuginfoUpgrade postgresql16-postgis-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-server-develUpgrade postgresql-docs-debuginfoUpgrade postgis-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgis-docsUpgrade pgvector-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgresql-pltcl-debuginfoUpgrade postgis-utilsUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgisUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgis-upgradeUpgrade postgis-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-test-debuginfo | Sep 15, 2026 | Sep 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub