Read the docs
TI-2025-11741 Aliases CVE-2025-12818GHSA-pr6x-gg24-6wfp

PostgreSQL libpq undersizes allocations, via integer wraparound

Priority LOW 26CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 25 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00364 30th percentileScored 2026-11-08
Fix Partial PostgreSQL: 18.1, 17.7, 16.11 +3Red Hat: 35 advisoriesRed Hat: 25 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL18 to before 18.1; 17 to before 17.7; 16 to before 16.11; 15 to before 15.15; 14 to before 14.20; before 13.2318.1, 17.7, 16.11, 15.15, 14.20, 13.23Patch availableCNA
  • PostgreSQL Vendor— Affected 18 to before 18.1; 17 to before 17.7; 16 to before 16.11; 15 to before 15.15; 14 to before 14.20; before 13.23 Fixed in 18.1, 17.7, 16.11, 15.15, 14.20, 13.23 Patch available CNA

Remediation

  • Fix · CNA PostgreSQL Fixed in 18.1, 17.7, 16.11, 15.15, 14.20, 13.23

Red Hat 35 advisories

  • RHSA-2026:8756 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql18-18.3-1.2.hum1@src
  • RHSA-2026:1736 Released 2026-02-02 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0865 Released 2026-01-20 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpq-devel-16.11-1.el10_0
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpq-16.11-1.el10_0
Show 32 more Red Hat advisories
  • RHSA-2026:0835 Released 2026-01-20 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) libpq-12.7-1.el8_2.3, libpq-devel-12.7-1.el8_2.3
  • RHSA-2026:0745 Released 2026-01-19 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpq-13.23-1.el9_6, libpq-devel-13.23-1.el9_6
  • RHSA-2026:0744 Released 2026-01-19 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpq-13.23-1.el8_4, libpq-devel-13.23-1.el8_4
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpq-13.23-1.el8_4, libpq-devel-13.23-1.el8_4
  • RHSA-2026:0746 Released 2026-01-19 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpq-13.23-1.el9_2, libpq-devel-13.23-1.el9_2
  • RHSA-2026:0695 Released 2026-01-15 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpq-13.23-1.el8_10, libpq-devel-13.23-1.el8_10
  • RHSA-2026:0594 Released 2026-01-14 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpq-devel-16.11-3.el10_1
    • Red Hat Enterprise Linux BaseOS (v. 10) libpq-16.11-3.el10_1
  • RHSA-2026:0524 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2026:0523 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
  • RHSA-2026:0525 Released 2026-01-13 · Red Hat rating Moderate
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.11-1.el10_1, postgresql-contrib-16.11-1.el10_1, postgresql-docs-16.11-1.el10_1 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.11-1.el10_1
  • RHSA-2026:0519 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2026:0493 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:0492 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2026:0491 Released 2026-01-13 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.23-1.el9_7, postgresql-contrib-13.23-1.el9_7, postgresql-plperl-13.23-1.el9_7 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.23-1.el9_7, postgresql-private-devel-13.23-1.el9_7, postgresql-server-devel-13.23-1.el9_7 +4
  • RHSA-2026:0458 Released 2026-01-12 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpq-13.23-1.el9_7, libpq-devel-13.23-1.el9_7
  • RHSA-2026:0455 Released 2026-01-12 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.23-1.el9_2, postgresql-contrib-13.23-1.el9_2, postgresql-plperl-13.23-1.el9_2 +5
  • RHSA-2026:0456 Released 2026-01-12 · Red Hat rating Moderate
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-16.11-1.el10_0, postgresql-contrib-16.11-1.el10_0, postgresql-docs-16.11-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) postgresql-test-rpm-macros-16.11-1.el10_0
  • RHSA-2026:0268 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6, postgresql-private-devel-13.23-1.el9_6, postgresql-server-devel-13.23-1.el9_6 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6, postgresql-contrib-13.23-1.el9_6, postgresql-plperl-13.23-1.el9_6 +5
  • RHSA-2026:0269 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:0264 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2026:0262 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) postgresql-docs-13.23-1.el9_4, postgresql-private-devel-13.23-1.el9_4, postgresql-server-devel-13.23-1.el9_4 +3
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) postgresql-13.23-1.el9_4, postgresql-contrib-13.23-1.el9_4, postgresql-plperl-13.23-1.el9_4 +5
  • RHSA-2026:0270 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:0267 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:0266 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2026:0265 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2026:0263 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) postgresql-13.23-1.el9_0, postgresql-contrib-13.23-1.el9_0, postgresql-plperl-13.23-1.el9_0 +5
  • RHSA-2025:23157 Released 2025-12-15 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpq-13.23-1.el8_8, libpq-devel-13.23-1.el8_8
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpq-13.23-1.el8_8, libpq-devel-13.23-1.el8_8
  • RHSA-2025:23158 Released 2025-12-15 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpq-13.23-1.el8_6, libpq-devel-13.23-1.el8_6
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) libpq-13.23-1.el8_6, libpq-devel-13.23-1.el8_6
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) libpq-13.23-1.el8_6, libpq-devel-13.23-1.el8_6
  • RHSA-2025:23123 Released 2025-12-11 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) libpq-13.23-1.el9_4, libpq-devel-13.23-1.el9_4
  • RHSA-2025:23124 Released 2025-12-11 · Red Hat rating Moderate
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) libpq-13.23-1.el9_0, libpq-devel-13.23-1.el9_0
  • RHSA-2025:23023 Released 2025-12-10 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2025:23022 Released 2025-12-10 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2025:22728 Released 2025-12-04 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 13.23, 14.20 and 4 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-11740 PostgreSQL CREATE STATISTICS does not check for schema CREATE privilegePriority LOW 15
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:0262
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:0268
Red Hat Discovery 2Fixed RHSA-2026:1736
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0525, RHSA-2026:0594
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:0519, RHSA-2026:0523, RHSA-2026:0524, RHSA-2026:0695
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0458, RHSA-2026:0491, RHSA-2026:0492, RHSA-2026:0493
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2026:0835
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0265, RHSA-2026:0744
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:23158, RHSA-2026:0267
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:23158, RHSA-2026:0267
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:23157, RHSA-2026:0266, RHSA-2026:0270
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:23124, RHSA-2026:0263
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:23022, RHSA-2026:0455, RHSA-2026:0746
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0456, RHSA-2026:0865
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:22728, RHSA-2025:23123, RHSA-2026:0262, RHSA-2026:0264
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:23023, RHSA-2026:0268, RHSA-2026:0269, RHSA-2026:0745
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0265, RHSA-2026:0744
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:23158, RHSA-2026:0267
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:23157, RHSA-2026:0266, RHSA-2026:0270
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:0594
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:0865
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:0525
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:0491
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:0456
Red Hat Hardened ImagesFixed RHSA-2026:8756
Not affected: 4 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12818
  2. 2026-10-03 Alias added: GHSA-pr6x-gg24-6wfp

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences