What is the CVSS score of EUVD-2026-30283?

EUVD-2026-30283 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-30283?

Within 24 hours: Inventory all systems running PostgreSQL client tools (psql, pg_dump) and identify which versions are affected; restrict administrative database connections to trusted, internally-controlled PostgreSQL servers only. Within 7 days: Apply vendor patches when released or implement network segmentation to prevent client systems from connecting to external/untrusted PostgreSQL instances; disable large object operations (lo_export, lo_read, lo_lseek64, lo_tell64) if not required. Within 30 days: Upgrade to patched PostgreSQL client library versions (monitor postgresql.org/support for release announcements); conduct forensic review of any historical connections to external or suspicious PostgreSQL servers.

PostgreSQL libpq EUVD-2026-30283

Q: Which versions of PostgreSQL libpq are affected by EUVD-2026-30283?

CVE-2026-6477 affects PostgreSQL's libpq client library, allowing malicious database servers to execute arbitrary code on administrative clients (psql, pg_dump) during routine operations like backups…. A patch is available.

| CVE-2026-6477 HIGH

Use of Inherently Dangerous Function (CWE-242)

2026-05-14 PostgreSQL

GHSA-jm5f-gpfq-q9h3

Information Disclosure PostgreSQL N A

8.8

CVSS 3.1 · Vendor: PostgreSQL

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Recon

Compromise PostgreSQL server
Delivery

Gain superuser privileges
Exploit

Wait for admin client connection
Install

Client invokes lo_* function
C2

Send oversized malicious response
Execute

Overflow client stack buffer
Impact

Execute arbitrary code on client

Vulnerability Assessment

Weakness	CWE CWE-242 ASVS 5.0 V15 - Secure Coding and Architecture Use of inherently dangerous function
Exploitation Conditions	Requires victim to connect PostgreSQL client tools (psql with \lo_export command or pg_dump) to an attacker-controlled or compromised PostgreSQL server where the attacker has server superuser privileges. Exploitation occurs when client operations invoke affected large object functions: lo_export(), lo_read(), lo_lseek64(), or lo_tell64(). Most commonly triggered during database backup operations (pg_dump automatically reads large objects) or manual large object export operations. The attack does NOT require the client user to have any special database privileges, but the attacker must control the server side. Default PostgreSQL client configurations are vulnerable, no special client-side settings required. Limits exploitation: victim must initiate connection to malicious server (social engineering or compromised infrastructure required); attacker must first achieve PostgreSQL superuser role on a server the victim will connect to.
Impact	CVSS 8.8 (High) with network vector, low complexity, no privileges required but user interaction required accurately reflects the attack prerequisites. The user interaction requirement (PR:N/UI:R) means administrators must connect their legitimate psql or pg_dump clients to a compromised PostgreSQL server, limiting casual exploitation. However, the impact is severe: complete compromise of client systems running database administrative tools with administrator privileges. The vulnerability inverts the typical database threat model where servers are protected from malicious clients, instead weaponizing the server against administrative clients. Real-world risk depends heavily on organizational trust models: environments with untrusted database servers or those connecting to third-party/customer-managed PostgreSQL instances face elevated risk. Internal-only, fully-trusted PostgreSQL deployments have lower practical risk unless an attacker first compromises the database server. SSVC technical impact is total (arbitrary code execution). Attack automation is limited by the need for attacker-controlled database server positioning. No EPSS or KEV data available at time of analysis, suggesting recent disclosure without observed exploitation. Priority should be highest for environments performing pg_dump backups against external or semi-trusted PostgreSQL servers.
Exploit ScenarioDerived	A database administrator connects pg_dump to perform a routine backup of a PostgreSQL server that has been compromised by an attacker who gained superuser access. During the backup operation, when pg_dump calls lo_read() to export large object data, the malicious server responds with a crafted, oversized response that overflows the client's stack buffer. The attacker's payload overwrites the return address on the stack, redirecting execution to shellcode that establishes a reverse shell with the administrator's privileges on the backup server.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 14, 2026

PostgreSQL libpq client library allows malicious server superusers to execute arbitrary code on connecting clients by overwriting stack buffers via unbounded responses to PQfn() calls. The vulnerability affects lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions used by psql and pg_dump utilities. A compromised or malicious PostgreSQL server can exploit clients running these common administrative tools during routine operations like database backups or large object exports. EPSS and KEV data not available for this recent CVE. CVSS 8.8 reflects the network attack vector with user interaction requirement (connecting to malicious server).

RemediationAI

Upgrade PostgreSQL client libraries and utilities to patched versions: 18.4, 17.10, 16.14, 15.18, or 14.23 or later as appropriate for your major version branch. Consult https://www.postgresql.org/support/security/CVE-2026-6477/ for release details and download links. Until patching is complete, implement these compensating controls: restrict pg_dump and psql usage to connect only to explicitly trusted PostgreSQL servers under your organization's administrative control; avoid using \lo_export commands or backing up databases containing large objects from untrusted sources; run pg_dump and psql with minimal operating system privileges using dedicated service accounts rather than administrative accounts to limit post-exploitation impact. Note that restricting client privileges reduces but does not eliminate risk since stack buffer overwrites can achieve code execution regardless of process privilege level. Network-level controls (limiting which servers clients can reach) provide more effective mitigation than permission restrictions. The only complete mitigation is patching the client library.

Affected VersionsENISA

PostgreSQL 17 <17.10

PostgreSQL 15 <15.18

PostgreSQL 16 <16.14

PostgreSQL 0 <14.23

PostgreSQL 18 <18.4

Affected Packages

euvd postgresql fix: 14.23, 15.18, 16.14, 17.10, 18.4

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

PostgreSQL libpq is the C client library for PostgreSQL database connections. The vulnerability stems from CWE-242 (Use of Inherently Dangerous Function) where PQfn() with result_is_int=0 parameter acts like the deprecated gets() function, storing server-provided data of arbitrary length into fixed-size client stack buffers without bounds checking. The affected large object (lo_*) functions use this unsafe PQfn() invocation pattern. When psql executes \lo_export commands or pg_dump performs backups involving large objects, these functions trust server responses without validating response length against local buffer capacity. CPE data indicates broad product impact across PostgreSQL versions. This represents a trust boundary violation where client-side code implicitly trusts server-provided metadata about response sizes.

Know when PostgreSQL gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (PostgreSQL) PRIMARY 8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE HIGH

Red Hat 8.4 HIGH

Primary rating from Vendor (PostgreSQL).

CVSS VectorVendor: PostgreSQL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

May 14, 2026 - 15:01 EUVD

CVE Published

May 14, 2026 - 13:00 nvd

HIGH 8.8

DescriptionCVE.org

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Executive ViewAI

Why It Matters

CVE-2026-6477 affects PostgreSQL's libpq client library, allowing malicious database servers to execute arbitrary code on administrative clients (psql, pg_dump) during routine operations like backups and exports. Organizations relying on PostgreSQL for critical data management face potential compromise of administrative workstations and lateral movement into internal networks when connecting to untrusted or compromised database instances.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict PostgreSQL client connections to internal, administratively-controlled servers only; (2) Implement network segmentation isolating administrative workstations from untrusted database infrastructure; (3) Disable or restrict large object export/import functions if operationally feasible; (4) Monitor outbound connections from systems running psql/pg_dump for connections to non-approved database servers; (5) Enforce client certificate authentication and disable password-based authentication to reduce server compromise risk.

Threat Intelligence Overview

EPSS Score

0.0%

Top 88% exploitable

Data Quality

7 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment MSRC Vendor

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +44

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-242 – Use of Inherently Dangerous Function

View all

CVE-2022-36310 HIGH POC

8.8

CVE-2024-52324 CRITICAL

9.2

8.8

8.1

7.8

7.8

7.3

7.8

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2025-68613 HIGH POC

8.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: High

Product	Status
SUSE Linux Enterprise Desktop 15 SP7 SUSE Linux Enterprise Module for Basesystem 15 SP7	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS	Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS	Fixed

References

Advisories & patches

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back

PostgreSQL libpq EUVD-2026-30283

Attack ChainAIDerived

Vulnerability Assessment

AnalysisAIv1 – May 14, 2026

RemediationAI

Affected VersionsENISA

Affected Packages

Affects your stack

Know when PostgreSQL gets its next vulnerability

Severity by source

CVSS VectorVendor: PostgreSQL

Lifecycle Timeline

DescriptionCVE.org

Executive ViewAI

Threat Intelligence Overview

How this decision was reached

SSVC AssessmentENISA

Priority Score

Attack Technique

More in PostgreSQL

Same weakness CWE-242 – Use of Inherently Dangerous Function

Same technique Information Disclosure

Vendor StatusVendor

SUSE

References

Search Externally