Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19009 advisory.

    - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator     executes arbitrary code
    - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
    - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
    - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:19009 advisory.

    * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:19009 advisory.

    PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package     contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML     documentation for the whole system.  These client programs can be located on the same machine as the     PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.
    The PostgreSQL server can be found in the postgresql-server sub-package.

    Security Fix(es):

    * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

    * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

    * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code     (CVE-2026-2006)

    * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes     arbitrary code (CVE-2026-2004)

    * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0881-1 advisory.

    Update to version 18.3 (bsc#1258754).

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

    Regression fixes:

      - the substring() function raises an error 'invalid byte sequence for encoding' on non-ASCII text values     if the         source of that value is a database column (caused by CVE-2026-2006 fix).
      - a standby may halt and return an error 'could not access status of transaction'.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 18 prior to 18.2. As such, it is potentially affected by a vulnerability:

  - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted     input string. The attacker has limited control over the byte patterns to be written, but we have not ruled     out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
    (CVE-2026-2007)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0585-1 advisory.

    Update to version 18.2.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0584-1 advisory.

    Update to version 18.2.

    Security issues fixed:

    - CVE-2026-2003: improper validation of type 'oidvector' may allow disclose a few bytes of server memory     (bsc#1258008).
    - CVE-2026-2004: intarray missing validation of type of input to selectivity estimator could lead to     arbitrary code       execution (bsc#1258009).
    - CVE-2026-2005: buffer overrun in contrib/pgcrypto's PGP decryption functions could lead to arbitrary     code execution       (bsc#1258010).
    - CVE-2026-2006: inadequate validation of multibyte character lengths could lead to arbitrary code     execution       (bsc#1258011).
    - CVE-2026-2007: pg_trgm heap buffer overflow can cause to write pattern onto server memory (bsc#1258012).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of
    server memory. We have not ruled out viability of attacks that arrange for presence of confidential
    information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12,
    15.16, and 14.21 are affected. (CVE-2026-2003)

  - Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows
    an object creator to execute arbitrary code as the operating system user running the database. Versions
    before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

  - Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the
    operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
    are affected. (CVE-2026-2005)

  - Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to
    issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the
    operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
    are affected. (CVE-2026-2006)

  - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted
    input string. The attacker has limited control over the byte patterns to be written, but we have not ruled
    out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
    (CVE-2026-2007)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e3afc190-0821-11f1-a857-6cc21735f730 advisory.

    The PostgreSQL project reports:

              Improper validation of type oidvector in PostgreSQL               allows a database user to disclose a few bytes of server               memory. We have not ruled out viability of attacks that               arrange for presence of confidential information in               disclosed bytes, but they seem unlikely.


              Missing validation of type of input in PostgreSQL               intarray extension selectivity estimator function allows               an object creator to execute arbitrary code as the               operating system user running the database.


              Heap buffer overflow in PostgreSQL pgcrypto allows a               ciphertext provider to execute arbitrary code as the               operating system user running the database.


              Missing validation of multibyte character length in               PostgreSQL text manipulation allows a database user to               issue crafted queries that achieve a buffer overrun.
              That suffices to execute arbitrary code as the operating               system user running the database.


              Heap buffer overflow in PostgreSQL pg_trgm allows a               database user to achieve unknown impacts via a crafted               input string. The attacker has limited control over the               byte patterns to be written, but we have not ruled out               the viability of attacks that lead to privilege               escalation.


Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted     input string. The attacker has limited control over the byte patterns to be written, but we have not ruled     out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
    (CVE-2026-2007)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
327057	Oracle Linux 10 : postgresql18 (ELSA-2026-19009)	Nessus	Oracle Linux Local Security Checks	high
318302	RockyLinux 10 : postgresql18 (RLSA-2026:19009)	Nessus	Rocky Linux Local Security Checks	high
315438	RHEL 10 : postgresql18 (RHSA-2026:19009)	Nessus	Red Hat Local Security Checks	high
302108	SUSE SLED15: libecpg6 / libecpg6-32bit / libpq5 / libpq5-32bit / postgresql18 / etc (SUSE-SU-2026:0881-1)	Nessus	SuSE Local Security Checks	high
299757	PostgreSQL 18.x < 18.2 Heap Buffer Overflow (CVE-2026-2007)	Nessus	Databases	high
299712	SUSE SLES12 Security Update : postgresql18 (SUSE-SU-2026:0585-1)	Nessus	SuSE Local Security Checks	high
299707	SUSE SLES15 Security Update : postgresql18 (SUSE-SU-2026:0584-1)	Nessus	SuSE Local Security Checks	high
437740	Alpine: postgresql15: security update to 15.16-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
437740	Alpine: postgresql15: security update to 15.16-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
437738	Alpine: multiple libecpg packages, multiple postgresql18 packages: security update to 18.2-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
437738	Alpine: multiple libecpg packages, multiple postgresql18 packages: security update to 18.2-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
437737	Alpine: multiple postgresql17 packages: security update to 17.8-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
437737	Alpine: multiple postgresql17 packages: security update to 17.8-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
437736	Alpine: postgresql16: security update to 16.12-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
437736	Alpine: postgresql16: security update to 16.12-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
299011	FreeBSD : PostgreSQL -- Multiple vulnerabilities (e3afc190-0821-11f1-a857-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
298888	Linux Distros Unpatched Vulnerability : CVE-2026-2007	Nessus	Misc.	high

Detections

Analytics

CVE-2026-2007

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high