DEBIAN-CVE-2026-6638
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.
DEBIAN-CVE-2026-6638
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-6638
postgresql-17
Source reference: /affected/0/package/name
- Affected versions
- 17.5-1
Source reference:
/affected/0/versions17.6-0+deb13u1Source reference:
/affected/0/versions17.6-1Source reference:
/affected/0/versions17.7-0+deb13u1Source reference:
/affected/0/versions17.8-0+deb13u1Source reference:
/affected/0/versions17.9-0+deb13u1Source reference:
/affected/0/versions - Fixed versions
- 17.10-0+deb13u1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
postgresql-18
Source reference: /affected/1/package/name
- Affected versions
- 18.0-1
Source reference:
/affected/1/versions18.1-1Source reference:
/affected/1/versions18.1-2Source reference:
/affected/1/versions18.2-1Source reference:
/affected/1/versions18.3-1Source reference:
/affected/1/versions18~beta1+20250612-1Source reference:
/affected/1/versions18~beta1+20250624-1Source reference:
/affected/1/versions18~beta1+20250701-1Source reference:
/affected/1/versions18~beta1-1Source reference:
/affected/1/versions18~beta2-1Source reference:
/affected/1/versions18~beta3-1Source reference:
/affected/1/versions18~rc1-1Source reference:
/affected/1/versions18~rc1-2Source reference:
/affected/1/versions18~rc1-3Source reference:
/affected/1/versions18~~devel.20250318+g4078da6c478-1Source reference:
/affected/1/versions18~~devel.20250331-1Source reference:
/affected/1/versions18~~devel.20250405-1Source reference:
/affected/1/versions18~~devel.20250421-1Source reference:
/affected/1/versions18~~devel.20250502-1Source reference:
/affected/1/versions - Fixed versions
- 18.4-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "17.10-0+deb13u1"
}
]
}
],
"package": {
"name": "postgresql-17",
"purl": "pkg:deb/debian/postgresql-17?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"17.5-1",
"17.6-0+deb13u1",
"17.6-1",
"17.7-0+deb13u1",
"17.8-0+deb13u1",
"17.9-0+deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6638.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "18.4-1"
}
]
}
],
"package": {
"name": "postgresql-18",
"purl": "pkg:deb/debian/postgresql-18?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"18.0-1",
"18.1-1",
"18.1-2",
"18.2-1",
"18.3-1",
"18~beta1+20250612-1",
"18~beta1+20250624-1",
"18~beta1+20250701-1",
"18~beta1-1",
"18~beta2-1",
"18~beta3-1",
"18~rc1-1",
"18~rc1-2",
"18~rc1-3",
"18~~devel.20250318+g4078da6c478-1",
"18~~devel.20250331-1",
"18~~devel.20250405-1",
"18~~devel.20250421-1",
"18~~devel.20250502-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6638.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58277 · Revision 1
- Added to Heist Feed
- Publisher date