CVE-2023-5868Medium· 4.3▾ SunlitA memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string l…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.6 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
2.8%
A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.
postgresql >= 11.0, < 11.22postgresql >= 12.0, < 12.17postgresql >= 13.0, < 13.13postgresql >= 14.0, < 14.10postgresql >= 15.0, < 15.5postgresql = 16.0codeready_linux_builder_eus = 9.2codeready_linux_builder_eus_for_power_little_endian_eus = 9.0_ppc64lecodeready_linux_builder_eus_for_power_little_endian_eus = 9.2_ppc64lecodeready_linux_builder_for_arm64_eus = 8.6_aarch64codeready_linux_builder_for_arm64_eus = 9.0_aarch64codeready_linux_builder_for_arm64_eus = 9.2_aarch64codeready_linux_builder_for_ibm_z_systems_eus = 9.0_s390xcodeready_linux_builder_for_ibm_z_systems_eus = 9.2_s390xcodeready_linux_builder_for_power_little_endian_eus = 9.0_ppc64lecodeready_linux_builder_for_power_little_endian_eus = 9.2_ppc64lesoftware_collections = 1.0enterprise_linux = 8.0enterprise_linux = 9.0enterprise_linux_eus = 8.6enterprise_linux_eus = 8.8enterprise_linux_eus = 9.0enterprise_linux_eus = 9.2enterprise_linux_for_arm_64 = 8.0enterprise_linux_for_arm_64 = 8.8_aarch64enterprise_linux_for_ibm_z_systems = 8.0_s390xenterprise_linux_for_ibm_z_systems_eus = 8.6_s390xenterprise_linux_for_ibm_z_systems_eus = 8.8_s390xenterprise_linux_for_ibm_z_systems_eus = 9.0_s390xenterprise_linux_for_ibm_z_systems_eus = 9.2_s390xenterprise_linux_for_power_little_endian = 8.0_ppc64leenterprise_linux_for_power_little_endian_eus = 8.6_ppc64leenterprise_linux_for_power_little_endian_eus = 8.8_ppc64leenterprise_linux_for_power_little_endian_eus = 9.0_ppc64leenterprise_linux_for_power_little_endian_eus = 9.2_ppc64leenterprise_linux_server_aus = 8.2enterprise_linux_server_aus = 8.4enterprise_linux_server_aus = 8.6enterprise_linux_server_aus = 9.2enterprise_linux_server_tus = 8.2enterprise_linux_server_tus = 8.4enterprise_linux_server_tus = 8.6Upgrade past the affected range:
postgresql 15.5Connected by shared product, vendor, weakness, or advisory.
CVE-2026-6471High· 7.2Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin
CVE-2026-6470Medium· 4.3Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type
CVE-2026-6469Low· 3.8Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user
CVE-2026-6464High· 8.1Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection
CVE-2026-19385High· 8.8Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list
CVE-2026-18408High· 8.8Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \re…