CVE-2026-2005

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
References
Link Resource
https://www.postgresql.org/support/security/CVE-2026-2005/ Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:19009
https://access.redhat.com/errata/RHSA-2026:19010
https://access.redhat.com/errata/RHSA-2026:3730
https://access.redhat.com/errata/RHSA-2026:3887
https://access.redhat.com/errata/RHSA-2026:3896
https://access.redhat.com/errata/RHSA-2026:4024
https://access.redhat.com/errata/RHSA-2026:4059
https://access.redhat.com/errata/RHSA-2026:4063
https://access.redhat.com/errata/RHSA-2026:4064
https://access.redhat.com/errata/RHSA-2026:4074
https://access.redhat.com/errata/RHSA-2026:4075
https://access.redhat.com/errata/RHSA-2026:4110
https://access.redhat.com/errata/RHSA-2026:4254
https://access.redhat.com/errata/RHSA-2026:4441
https://access.redhat.com/errata/RHSA-2026:4475
https://access.redhat.com/errata/RHSA-2026:4504
https://access.redhat.com/errata/RHSA-2026:4505
https://access.redhat.com/errata/RHSA-2026:4506
https://access.redhat.com/errata/RHSA-2026:4509
https://access.redhat.com/errata/RHSA-2026:4515
https://access.redhat.com/errata/RHSA-2026:4516
https://access.redhat.com/errata/RHSA-2026:4518
https://access.redhat.com/errata/RHSA-2026:4524
https://access.redhat.com/errata/RHSA-2026:4528
https://access.redhat.com/errata/RHSA-2026:4544
https://access.redhat.com/errata/RHSA-2026:4546
https://access.redhat.com/errata/RHSA-2026:4547
https://access.redhat.com/errata/RHSA-2026:4548
https://access.redhat.com/errata/RHSA-2026:4943
https://access.redhat.com/errata/RHSA-2026:8756
https://access.redhat.com/security/cve/CVE-2026-2005
https://bugzilla.redhat.com/show_bug.cgi?id=2439326
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2005.json
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

History

30 Jun 2026, 03:18

Type Values Removed Values Added
References
  • () https://access.redhat.com/errata/RHSA-2026:19009 -
  • () https://access.redhat.com/errata/RHSA-2026:19010 -
  • () https://access.redhat.com/errata/RHSA-2026:3730 -
  • () https://access.redhat.com/errata/RHSA-2026:3887 -
  • () https://access.redhat.com/errata/RHSA-2026:3896 -
  • () https://access.redhat.com/errata/RHSA-2026:4024 -
  • () https://access.redhat.com/errata/RHSA-2026:4059 -
  • () https://access.redhat.com/errata/RHSA-2026:4063 -
  • () https://access.redhat.com/errata/RHSA-2026:4064 -
  • () https://access.redhat.com/errata/RHSA-2026:4074 -
  • () https://access.redhat.com/errata/RHSA-2026:4075 -
  • () https://access.redhat.com/errata/RHSA-2026:4110 -
  • () https://access.redhat.com/errata/RHSA-2026:4254 -
  • () https://access.redhat.com/errata/RHSA-2026:4441 -
  • () https://access.redhat.com/errata/RHSA-2026:4475 -
  • () https://access.redhat.com/errata/RHSA-2026:4504 -
  • () https://access.redhat.com/errata/RHSA-2026:4505 -
  • () https://access.redhat.com/errata/RHSA-2026:4506 -
  • () https://access.redhat.com/errata/RHSA-2026:4509 -
  • () https://access.redhat.com/errata/RHSA-2026:4515 -
  • () https://access.redhat.com/errata/RHSA-2026:4516 -
  • () https://access.redhat.com/errata/RHSA-2026:4518 -
  • () https://access.redhat.com/errata/RHSA-2026:4524 -
  • () https://access.redhat.com/errata/RHSA-2026:4528 -
  • () https://access.redhat.com/errata/RHSA-2026:4544 -
  • () https://access.redhat.com/errata/RHSA-2026:4546 -
  • () https://access.redhat.com/errata/RHSA-2026:4547 -
  • () https://access.redhat.com/errata/RHSA-2026:4548 -
  • () https://access.redhat.com/errata/RHSA-2026:4943 -
  • () https://access.redhat.com/errata/RHSA-2026:8756 -
  • () https://access.redhat.com/security/cve/CVE-2026-2005 -
  • () https://bugzilla.redhat.com/show_bug.cgi?id=2439326 -
  • () https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2005.json -
CWE CWE-120

17 Jun 2026, 10:29

Type Values Removed Values Added
Summary
  • (es) Un desbordamiento de búfer en el heap en PostgreSQL pgcrypto permite a un proveedor de texto cifrado ejecutar código arbitrario como el usuario del sistema operativo que ejecuta la base de datos. Las versiones anteriores a PostgreSQL 18.2, 17.8, 16.12, 15.16 y 14.21 están afectadas.

20 Feb 2026, 19:54

Type Values Removed Values Added
First Time Postgresql
Postgresql postgresql
CPE cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
References () https://www.postgresql.org/support/security/CVE-2026-2005/ - () https://www.postgresql.org/support/security/CVE-2026-2005/ - Vendor Advisory

12 Feb 2026, 14:16

Type Values Removed Values Added
New CVE

Information

Published : 2026-02-12 14:16

Updated : 2026-07-15 02:19


NVD link : CVE-2026-2005

Mitre link : CVE-2026-2005

CVE.ORG link : CVE-2026-2005


JSON object : View

Products Affected

postgresql

  • postgresql
CWE
CWE-122

Heap-based Buffer Overflow

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')