# CVE-2026-2007: postgresql18: This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixe... CVE-2026-2007 is fixed in 16 products on 1 platform, first by RHSA-2026:19009, released February 12, 2026. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2026-2007 - Priority: High - CVSS: 8.8 (high) - EPSS: 0.0054 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 12, 2026 ## Description This update for postgresql18 fixes the following issues: Update to version 18.3 (bsc#1258754). Security issues fixed: - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory (bsc#1258008). - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to arbitrary code execution (bsc#1258009). - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary code execution (bsc#1258010). - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code execution (bsc#1258011). - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012). Regression fixes: - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values if the source of that value is a database column (caused by CVE-2026-2006 fix). - a standby may halt and return an error 'could not access status of transaction'. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | postgresql-18 Debian 14 | 18.2-1 | [DEBIAN-CVE-2026-2007](https://patchblox.com/security/data/fix/linux/debian-cve-2026-2007.md) | Feb 12, 2026 | | Linux | postgresql18 RHEL 10 | 18.3-1.el10_2 | [RHSA-2026:19009](https://patchblox.com/security/data/fix/linux/rhsa-2026-19009.md) | Feb 12, 2026 | | Linux | postgresql18 almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18 ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18 opensuse-leap 15.6 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 opensuse-leap 16.0 | 18.3-160000.1.1 | [OPENSUSE-SU-2026:20408-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20408-1.md) | Mar 20, 2026 | | Linux | postgresql18 rocky 10 | 0:18.3-1.el10 | [RLSA-2026:19009](https://patchblox.com/security/data/fix/linux/rlsa-2026-19009.md) | May 29, 2026 | | Linux | postgresql18 sles 15.6 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 sles 15.7 | 18.3-150600.13.8.1 | [SUSE-SU-2026:0881-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-0881-1.md) | Mar 12, 2026 | | Linux | postgresql18 sles 16.0 | 18.3-160000.1.1 | [SUSE-SU-2026:20921-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-20921-1.md) | Mar 20, 2026 | | Linux | postgresql18-contrib almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-contrib ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-docs almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-docs ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-mini opensuse-leap 16.0 | 18.3-160000.1.1 | [OPENSUSE-SU-2026:20408-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-20408-1.md) | Mar 20, 2026 | | Linux | postgresql18-plperl almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-plperl ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-plpython3 almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-plpython3 ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-private-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-private-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-private-libs almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-private-libs ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-server almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-server ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-server-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-server-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-static almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-static ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-test almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-test ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-test-rpm-macros almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-test-rpm-macros ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-upgrade almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-upgrade ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | | Linux | postgresql18-upgrade-devel almalinux 10 | 18.3-1.el10_2 | [ALSA-2026:19009](https://patchblox.com/security/data/fix/linux/alsa-2026-19009.md) | May 19, 2026 | | Linux | postgresql18-upgrade-devel ol 10 | 0:18.3-1.0.1.el10_2 | [ELSA-2026-19009](https://patchblox.com/security/data/fix/linux/elsa-2026-19009.md) | Jul 8, 2026 | --- Data as of 2026-11-10T07:50:38Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.