postgresql17 (SUSE:Linux Enterprise Server 16.0) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Server 16.0 package postgresql17, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (16)

• CVE-2026-6637 — CVSS 8.8 (high): Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system…
• CVE-2026-2004 — CVSS 8.8 (high): Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute…
• CVE-2026-2005 — CVSS 8.8 (high): Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the…
• CVE-2026-2006 — CVSS 8.8 (high): Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that…
• CVE-2026-6473 — CVSS 8.8 (high): Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an…
• CVE-2026-6475 — CVSS 8.8 (high): Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g…
• CVE-2026-6477 — CVSS 8.8 (high): Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and…
• CVE-2026-6479 — CVSS 7.5 (high): Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve…
• CVE-2026-6476 — CVSS 7.2 (high): SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a…
• CVE-2026-6478 — CVSS 6.5 (medium): Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials…
• CVE-2025-12818 — CVSS 5.9 (medium): Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause…
• CVE-2026-6472 — CVSS 5.4 (medium): Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined…
• CVE-2026-6474 — CVSS 4.3 (medium): Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via…
• CVE-2026-2003 — CVSS 4.3 (medium): Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled…
• CVE-2026-6638 — CVSS 3.7 (low): SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute…
• CVE-2025-12817 — CVSS 3.1 (low): Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE…