What’s Vulnerable › Vulnerabilities
CVE-2026-6637: PostgreSQL refint allows stack buffer overflow and SQL injection
- Severity: high (CVSS 8.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-05-14 · updated 2026-06-17
- Weakness: CWE-89
Description
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Affected products
- PostgreSQL: before 14.23; from 15.0 before 15.18; from 16.0 before 16.14; from 17.0 before 17.10; from 18.0 before 18.4 — fixed in 14.23, 15.18, 16.14, 17.10, 18.4
How to fix
Upgrade to a fixed version: PostgreSQL 14.23, 15.18, 16.14, 17.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-6637 or the next vulnerability affects your stack