DEBIAN-CVE-2026-14681
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.
DEBIAN-CVE-2026-14681
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-14681
postgresql-17
Source reference: /affected/0/package/name
- Affected versions
- 17.10-0+deb13u1
Source reference:
/affected/0/versions17.5-1Source reference:
/affected/0/versions17.6-0+deb13u1Source reference:
/affected/0/versions17.6-1Source reference:
/affected/0/versions17.7-0+deb13u1Source reference:
/affected/0/versions17.8-0+deb13u1Source reference:
/affected/0/versions17.9-0+deb13u1Source reference:
/affected/0/versions - Fixed versions
- 17.11-0+deb13u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
postgresql-18
Source reference: /affected/1/package/name
- Affected versions
- 18.0-1
Source reference:
/affected/1/versions18.1-1Source reference:
/affected/1/versions18.1-2Source reference:
/affected/1/versions18.2-1Source reference:
/affected/1/versions18.3-1Source reference:
/affected/1/versions18.4-1Source reference:
/affected/1/versions18~beta1+20250612-1Source reference:
/affected/1/versions18~beta1+20250624-1Source reference:
/affected/1/versions18~beta1+20250701-1Source reference:
/affected/1/versions18~beta1-1Source reference:
/affected/1/versions18~beta2-1Source reference:
/affected/1/versions18~beta3-1Source reference:
/affected/1/versions18~rc1-1Source reference:
/affected/1/versions18~rc1-2Source reference:
/affected/1/versions18~rc1-3Source reference:
/affected/1/versions18~~devel.20250318+g4078da6c478-1Source reference:
/affected/1/versions18~~devel.20250331-1Source reference:
/affected/1/versions18~~devel.20250405-1Source reference:
/affected/1/versions18~~devel.20250421-1Source reference:
/affected/1/versions18~~devel.20250502-1Source reference:
/affected/1/versions - Fixed versions
- 18.6-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "17.11-0+deb13u1"
}
]
}
],
"package": {
"name": "postgresql-17",
"purl": "pkg:deb/debian/postgresql-17?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"17.10-0+deb13u1",
"17.5-1",
"17.6-0+deb13u1",
"17.6-1",
"17.7-0+deb13u1",
"17.8-0+deb13u1",
"17.9-0+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-14681.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.6-1"
}
]
}
],
"package": {
"name": "postgresql-18",
"purl": "pkg:deb/debian/postgresql-18?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"18.0-1",
"18.1-1",
"18.1-2",
"18.2-1",
"18.3-1",
"18.4-1",
"18~beta1+20250612-1",
"18~beta1+20250624-1",
"18~beta1+20250701-1",
"18~beta1-1",
"18~beta2-1",
"18~beta3-1",
"18~rc1-1",
"18~rc1-2",
"18~rc1-3",
"18~~devel.20250318+g4078da6c478-1",
"18~~devel.20250331-1",
"18~~devel.20250405-1",
"18~~devel.20250421-1",
"18~~devel.20250502-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-14681.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #56109 · Revision 1
- Added to Heist Feed
- Publisher date