Multiple critical remote vulnerabilities disclosed in PostgreSQL allowing RCE, data breach, and DoS
Multiple critical security vulnerabilities have been identified in PostgreSQL versions prior to 15.20, 16.16, 17.12, 18.7, 19 RC 2, and before 14.25, the latter of which has reached end of life and is no longer supported. These vulnerabilities allow attackers to perform remote code execution (RCE), cause remote denial of service (DoS), bypass security policies, and compromise data confidentiality. The PostgreSQL project released patches on November 12, 2026, addressing these issues. Immediate upgrade to supported versions including 15.20, 16.16, 17.12, 18.7, and 19 RC 2 is recommended to mitigate exploitation risks. The detailed list includes over thirty CVEs such as CVE-2026-116303 and CVE-2026-120139. Users are advised to consult the official PostgreSQL security bulletin for specific patching instructions.
Entenda a falha
A vulnerabilidade
PostgreSQL released a bulletin on 12 November 2026 covering more than fifty CVEs (for example CVE-2026-116303 and CVE-2026-120139). CERT-FR says some of them allow remote arbitrary code execution, remote denial of service, security policy bypass and loss of data confidentiality. The articles do not say which CVE does what, what an attacker needs (authentication, configuration) or what the CVSS scores are, so no single CVE can be ranked as the most severe. Affected: 15.x before 15.20, 16.x before 16.16, 17.x before 17.12, 18.x before 18.7, 19 before 19 RC 2, and versions before 14.25. Version 14 is end of life and gets no more updates, so migrate to a supported version.
Como foi descoberta
The articles do not say who found the flaws or how. They only show disclosure through the official PostgreSQL release bulletin of 12 November 2026, which shipped the fixed versions 15.20, 16.16, 17.12, 18.7, 14.25 and 19 RC 2. CERT-FR then published advisory CERTFR-2026-AVI-1530 on 13 November 2026, pointing to the vendor bulletin for the patches.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:28.
Linha do tempo
-
Multiple critical remote vulnerabilities disclosed in PostgreSQL allowing RCE, data breach, and DoS
ler a análise desta fonte ocultar
Multiple critical security vulnerabilities have been identified in PostgreSQL versions prior to 15.20, 16.16, 17.12, 18.7, 19 RC 2, and before 14.25, the latter of which has reached end of life and is no longer supported. These vulnerabilities allow attackers to perform remote code execution (RCE), cause remote denial of service (DoS), bypass security policies, and compromise data confidentiality. The PostgreSQL project released patches on November 12, 2026, addressing these issues. Immediate upgrade to supported versions including 15.20, 16.16, 17.12, 18.7, and 19 RC 2 is recommended to mitigate exploitation risks. The detailed list includes over thirty CVEs such as CVE-2026-116303 and CVE-2026-120139. Users are advised to consult the official PostgreSQL security bulletin for specific patching instructions.