postgresql18: This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixe...
CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High.
This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory (bsc#1258008). - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code execution (bsc#1258009). - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary code execution (bsc#1258010). - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution (bsc#1258011). - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012). Regression fixes: - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values if the source of that value is a database column (caused by CVE-2026-2006 fix). - a standby may halt and return an error 'could not access status of transaction'.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| postgresql-18 · Debian 14 | 18.2-1 | DEBIAN-CVE-2026-2007 | Feb 12, 2026 |
| postgresql18 · RHEL 10 | 18.3-1.el10_2 | RHSA-2026:19009 | Feb 12, 2026 |
| postgresql18 · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18 · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18 · opensuse-leap 15.6 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · opensuse-leap 16.0 | 18.3-160000.1.1 | OPENSUSE-SU-2026:20408-1 | Mar 20, 2026 |
| postgresql18 · rocky 10 | 0:18.3-1.el10 | RLSA-2026:19009 | May 29, 2026 |
| postgresql18 · sles 15.6 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · sles 15.7 | 18.3-150600.13.8.1 | SUSE-SU-2026:0881-1 | Mar 12, 2026 |
| postgresql18 · sles 16.0 | 18.3-160000.1.1 | SUSE-SU-2026:20921-1 | Mar 20, 2026 |
| postgresql18-contrib · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-contrib · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-docs · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-docs · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-mini · opensuse-leap 16.0 | 18.3-160000.1.1 | OPENSUSE-SU-2026:20408-1 | Mar 20, 2026 |
| postgresql18-plperl · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-plperl · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-plpython3 · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-plpython3 · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-private-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-private-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-private-libs · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-private-libs · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-server · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-server · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-server-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-server-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-static · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-static · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-test · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-test · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-test-rpm-macros · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-test-rpm-macros · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-upgrade · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-upgrade · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
| postgresql18-upgrade-devel · almalinux 10 | 18.3-1.el10_2 | ALSA-2026:19009 | May 19, 2026 |
| postgresql18-upgrade-devel · ol 10 | 0:18.3-1.0.1.el10_2 | ELSA-2026-19009 | Jul 8, 2026 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.