BIT-postgresql-2026-6470

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2026-6470.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-postgresql-2026-6470

Aliases

CVE-2026-6470

Published

2026-08-19T08:53:04.461Z

Modified

2026-08-19T09:45:24.748101361Z

Summary

PostgreSQL fails to check type USAGE privilege

Details

Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Database specific

{
    "cpes": [
        "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*"
    ],
    "severity": "Medium"
}

References

Affected packages

Bitnami / postgresql

Package

Name: postgresql
Purl: pkg:bitnami/postgresql

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

14.24.0

Introduced

15.0.0

Fixed

15.19.0

Introduced

16.0.0

Fixed

16.15.0

Introduced

17.0.0

Fixed

17.11.0

Introduced

18.0.0

Fixed

18.5.0

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/postgresql/BIT-postgresql-2026-6470.json"