Skip to content
Heist/ feed
UnratedFix available

DEBIAN-CVE-2026-14681

Type: advisorySource: OSV1 source record

Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.

Announced Source revision 1
Original source ↗

DEBIAN-CVE-2026-14681

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:DEBIAN-CVE-2026-14681

postgresql-17

Source reference: /affected/0/package/name

Affected versions
17.10-0+deb13u1

Source reference: /affected/0/versions

17.5-1

Source reference: /affected/0/versions

17.6-0+deb13u1

Source reference: /affected/0/versions

17.6-1

Source reference: /affected/0/versions

17.7-0+deb13u1

Source reference: /affected/0/versions

17.8-0+deb13u1

Source reference: /affected/0/versions

17.9-0+deb13u1

Source reference: /affected/0/versions

Fixed versions
17.11-0+deb13u1

Source reference: /affected/0/ranges

Prerequisites
Not stated in this record

postgresql-18

Source reference: /affected/1/package/name

Affected versions
18.0-1

Source reference: /affected/1/versions

18.1-1

Source reference: /affected/1/versions

18.1-2

Source reference: /affected/1/versions

18.2-1

Source reference: /affected/1/versions

18.3-1

Source reference: /affected/1/versions

18.4-1

Source reference: /affected/1/versions

18~beta1+20250612-1

Source reference: /affected/1/versions

18~beta1+20250624-1

Source reference: /affected/1/versions

18~beta1+20250701-1

Source reference: /affected/1/versions

18~beta1-1

Source reference: /affected/1/versions

18~beta2-1

Source reference: /affected/1/versions

18~beta3-1

Source reference: /affected/1/versions

18~rc1-1

Source reference: /affected/1/versions

18~rc1-2

Source reference: /affected/1/versions

18~rc1-3

Source reference: /affected/1/versions

18~~devel.20250318+g4078da6c478-1

Source reference: /affected/1/versions

18~~devel.20250331-1

Source reference: /affected/1/versions

18~~devel.20250405-1

Source reference: /affected/1/versions

18~~devel.20250421-1

Source reference: /affected/1/versions

18~~devel.20250502-1

Source reference: /affected/1/versions

Fixed versions
18.6-1

Source reference: /affected/1/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "17.11-0+deb13u1"
          }
        ]
      }
    ],
    "package": {
      "name": "postgresql-17",
      "purl": "pkg:deb/debian/postgresql-17?arch=source&distro=trixie",
      "ecosystem": "Debian:13"
    },
    "versions": [
      "17.10-0+deb13u1",
      "17.5-1",
      "17.6-0+deb13u1",
      "17.6-1",
      "17.7-0+deb13u1",
      "17.8-0+deb13u1",
      "17.9-0+deb13u1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-14681.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "18.6-1"
          }
        ]
      }
    ],
    "package": {
      "name": "postgresql-18",
      "purl": "pkg:deb/debian/postgresql-18?arch=source&distro=forky",
      "ecosystem": "Debian:14"
    },
    "versions": [
      "18.0-1",
      "18.1-1",
      "18.1-2",
      "18.2-1",
      "18.3-1",
      "18.4-1",
      "18~beta1+20250612-1",
      "18~beta1+20250624-1",
      "18~beta1+20250701-1",
      "18~beta1-1",
      "18~beta2-1",
      "18~beta3-1",
      "18~rc1-1",
      "18~rc1-2",
      "18~rc1-3",
      "18~~devel.20250318+g4078da6c478-1",
      "18~~devel.20250331-1",
      "18~~devel.20250405-1",
      "18~~devel.20250421-1",
      "18~~devel.20250502-1"
    ],
    "database_specific": {
      "source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-14681.json"
    },
    "ecosystem_specific": {
      "urgency": "not yet assigned"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#56109 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement