UnratedFix available
postgresql: Fix of 6 CVEs
Type: advisorySources: OSV
- CVE-2026-14678: fix out-of-bounds read in pg_trgm's GiST picksplit function with all-true signatures - CVE-2026-6470: require USAGE privilege on the subtype in CREATE TYPE AS RANGE, on the composite type in ALTER TABLE OF, and on the types used by stored expressions (defaults, constraints, indexes, policies, rules, triggers, partition keys, domains and function parameter defaults) - CVE-2026-18024: fix out-of-bounds read in ascii() on invalid or truncated multibyte characters - CVE-2026-14666: invalidate cached plans that depend on row-level security after role membership or role attribute changes - CVE-2026-14663: make pgcrypto's PGP encryption fail when the cipher cannot be initialized instead of emitting the plaintext; add the ignore-cipher-failure decryption option to recover such messages
- Products
- postgresql, postgresql-contrib, postgresql-docs, postgresql-plperl, postgresql-plpython3, postgresql-pltcl, postgresql-private-devel, postgresql-private-libs, postgresql-server, postgresql-server-devel, postgresql-static, postgresql-test, postgresql-test-rpm-macros, postgresql-upgrade, postgresql-upgrade-devel
- Affected versions
- Not specified
- Fixed versions
- 13.23-1.el9_6.tuxcare.els15
- CVEs
- CVE-2026-14663, CVE-2026-14666, CVE-2026-14678, CVE-2026-18024, CVE-2026-6470
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:49 UTC · Revision 1
Source evidence
- CVE-2026-14678: fix out-of-bounds read in pg_trgm's GiST picksplit function with all-true signatures - CVE-2026-6470: require USAGE privilege on the subtype in CREATE TYPE AS RANGE, on the composite type in ALTER TABLE OF, and on the types used by stored expressions (defaults, constraints, indexes, policies, rules, triggers, partition keys, domains and function parameter defaults) - CVE-2026-18024: fix out-of-bounds read in ascii() on invalid or truncated multibyte characters - CVE-2026-14666: invalidate cached plans that depend on row-level security after role membership or role attribute changes - CVE-2026-14663: make pgcrypto's PGP encryption fail when the cipher cannot be initialized instead of emitting the plaintext; add the ignore-cipher-failure decryption option to recover such messages
osv:CLSA-2026-1792796702
postgresql
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-contrib
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-docs
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-plperl
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-plpython3
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-pltcl
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-private-devel
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-private-libs
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-server
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-server-devel
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-static
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-test
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-test-rpm-macros
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-upgrade
Fixed versions: 13.23-1.el9_6.tuxcare.els15
postgresql-upgrade-devel
Fixed versions: 13.23-1.el9_6.tuxcare.els15
Complete source record
{
"id": "d5efd24aa34eee4e8925d9d66051dcbe6f259640aa9fd79029881dae4f28274a",
"url": "https://osv.dev/vulnerability/CLSA-2026-1792796702",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "postgresql: Fix of 6 CVEs",
"summary": "- CVE-2026-14678: fix out-of-bounds read in pg_trgm's GiST picksplit function with all-true signatures - CVE-2026-6470: require USAGE privilege on the subtype in CREATE TYPE AS RANGE, on the composite type in ALTER TABLE OF, and on the types used by stored expressions (defaults, constraints, indexes, policies, rules, triggers, partition keys, domains and function parameter defaults) - CVE-2026-18024: fix out-of-bounds read in ascii() on invalid or truncated multibyte characters - CVE-2026-14666: invalidate cached plans that depend on row-level security after role membership or role attribute changes - CVE-2026-14663: make pgcrypto's PGP encryption fail when the cipher cannot be initialized instead of emitting the plaintext; add the ignore-cipher-failure decryption option to recover such messages",
"evidence": "osv:CLSA-2026-1792796702",
"products": [
{
"name": {
"value": "postgresql",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-contrib",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-docs",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-plperl",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-plpython3",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-pltcl",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-private-devel",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-private-libs",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-server",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-server-devel",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-static",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-test",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-test-rpm-macros",
"evidence": "/affected/12/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/12/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-upgrade",
"evidence": "/affected/13/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/13/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql-upgrade-devel",
"evidence": "/affected/14/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "13.23-1.el9_6.tuxcare.els15",
"evidence": "/affected/14/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1792796702",
"aliases": [
"CLSA-2026-1792796702"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql",
"purl": "pkg:rpm/tuxcare/postgresql?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-contrib",
"purl": "pkg:rpm/tuxcare/postgresql-contrib?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-docs",
"purl": "pkg:rpm/tuxcare/postgresql-docs?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-plperl",
"purl": "pkg:rpm/tuxcare/postgresql-plperl?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-plpython3",
"purl": "pkg:rpm/tuxcare/postgresql-plpython3?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-pltcl",
"purl": "pkg:rpm/tuxcare/postgresql-pltcl?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-private-devel",
"purl": "pkg:rpm/tuxcare/postgresql-private-devel?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-private-libs",
"purl": "pkg:rpm/tuxcare/postgresql-private-libs?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-server",
"purl": "pkg:rpm/tuxcare/postgresql-server?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-server-devel",
"purl": "pkg:rpm/tuxcare/postgresql-server-devel?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-static",
"purl": "pkg:rpm/tuxcare/postgresql-static?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-test",
"purl": "pkg:rpm/tuxcare/postgresql-test?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-test-rpm-macros",
"purl": "pkg:rpm/tuxcare/postgresql-test-rpm-macros?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-upgrade",
"purl": "pkg:rpm/tuxcare/postgresql-upgrade?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "13.23-1.el9_6.tuxcare.els15"
}
]
}
],
"package": {
"name": "postgresql-upgrade-devel",
"purl": "pkg:rpm/tuxcare/postgresql-upgrade-devel?distro=almalinux-9.6",
"ecosystem": "TuxCare:AlmaLinux:9.6"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1792796702.json"
}
}
],
"modified": "2026-10-26T09:43:27.232122361Z",
"provider": "osv",
"upstream": [
"CVE-2026-14663",
"CVE-2026-14666",
"CVE-2026-14678",
"CVE-2026-18024",
"CVE-2026-6470"
],
"references": [
"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1792796702.html",
"https://nvd.nist.gov/vuln/detail/CVE-2025-12817",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14663",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14666",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14678",
"https://nvd.nist.gov/vuln/detail/CVE-2026-18024",
"https://nvd.nist.gov/vuln/detail/CVE-2026-6470"
]
},
"related_cves": [
{
"value": "CVE-2026-14663",
"evidence": "/upstream"
},
{
"value": "CVE-2026-14666",
"evidence": "/upstream"
},
{
"value": "CVE-2026-14678",
"evidence": "/upstream"
},
{
"value": "CVE-2026-18024",
"evidence": "/upstream"
},
{
"value": "CVE-2026-6470",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 449916,
"published_at": "2026-10-25T10:46:04+00:00"
}