Skip to main content

PostgreSQL libpq CVE-2026-6477

| EUVDEUVD-2026-30283 HIGH
Use of Inherently Dangerous Function (CWE-242)
2026-05-14 PostgreSQL GHSA-jm5f-gpfq-q9h3
Information Disclosure PostgreSQL
8.8
CVSS 3.1 · Vendor: PostgreSQL
Share

Severity by source

Vendor (PostgreSQL) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
8.4 HIGH
qualitative

Primary rating from Vendor (PostgreSQL).

CVSS VectorVendor: PostgreSQL

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch available
May 14, 2026 - 15:01 EUVD
Analysis Generated
May 14, 2026 - 14:01 vuln.today
CVE Published
May 14, 2026 - 13:00 nvd
HIGH 8.8

DescriptionCVE.org

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

AnalysisAI

PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).

Technical ContextAI

PostgreSQL libpq is the C client library for PostgreSQL database connections. The vulnerability stems from CWE-242 (Use of Inherently Dangerous Function) where PQfn() with result_is_int=0 parameter acts like the deprecated gets() function, storing server-provided data of arbitrary length into fixed-size client stack buffers without bounds checking. The affected large object (lo_*) functions use this unsafe PQfn() invocation pattern. When psql executes \lo_export commands or pg_dump performs backups involving large objects, these functions trust server responses without validating response length against local buffer capacity. CPE data indicates broad product impact across PostgreSQL versions. This represents a trust boundary violation where client-side code implicitly trusts server-provided metadata about response sizes.

RemediationAI

Upgrade PostgreSQL client libraries and utilities to patched versions: 18.4, 17.10, 16.14, 15.18, or 14.23 or later as appropriate for your major version branch. Consult https://www.postgresql.org/support/security/CVE-2026-6477/ for release details and download links. Until patching is complete, implement these compensating controls: restrict pg_dump and psql usage to connect only to explicitly trusted PostgreSQL servers under your organization's administrative control; avoid using \lo_export commands or backing up databases containing large objects from untrusted sources; run pg_dump and psql with minimal operating system privileges using dedicated service accounts rather than administrative accounts to limit post-exploitation impact. Note that restricting client privileges reduces but does not eliminate risk since stack buffer overwrites can achieve code execution regardless of process privilege level. Network-level controls (limiting which servers clients can reach) provide more effective mitigation than permission restrictions. The only complete mitigation is patching the client library.

More in PostgreSQL

View all
CVE-2025-1094 HIGH POC
8.1 Feb 13

PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
CVE-2024-55964 CRITICAL POC
9.8 Mar 26

An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
CVE-2013-1899 MEDIUM POC
6.5 Apr 04

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
CVE-2026-20253 CRITICAL POC
9.8 Jun 10

Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
CVE-2017-7546 CRITICAL
9.8 Aug 16

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
CVE-2015-1352 MEDIUM POC
5.0 Mar 30

The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
CVE-2024-10553 CRITICAL POC
9.8 Mar 20

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
CVE-2019-9193 HIGH POC
7.2 Apr 01

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
CVE-2026-40887 CRITICAL POC
9.1 Apr 14

## Summary An unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query strin
CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2025-56157 CRITICAL POC
9.8 Dec 18

Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
CVE-2024-12909 CRITICAL POC
9.8 Mar 20

A vulnerability in the FinanceChatLlamaPack of the run-llama/llama_index repository, versions up to v0.12.3, allows for

Same weakness CWE-242 – Use of Inherently Dangerous Function

View all
CVE-2022-36310 HIGH POC
8.8
CVE-2024-52324 CRITICAL
9.2
CVE-2025-49215 HIGH
8.8
CVE-2017-0904 HIGH
8.1
CVE-2025-1331 HIGH
7.8
CVE-2021-42543 HIGH
7.8
CVE-2025-1994 HIGH
7.8

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed

Share

CVE-2026-6477 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy