DEBIAN-CVE-2026-6460
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-6460
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-6460.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-6460
- Upstream
- CVE-2026-6460
- Published
- 2026-11-12T15:17:51Z
- Modified
- 2026-11-13T07:47:35Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
- References
Affected packages
Debian:12 / postgresql-15
Package
- Name
- postgresql-15
- Purl
- pkg:deb/debian/postgresql-15?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
15.*
15.3-0+deb12u1
15.3-1
15.4-0+deb12u1
15.4-1
15.4-2
15.4-3
15.5-0+deb12u1
15.6-0+deb12u1
15.7-0+deb12u1
15.8-0+deb12u1
15.9-0+deb12u1
15.10-0+deb12u1
15.11-0+deb12u1
15.12-0+deb12u1
15.12-0+deb12u2
15.13-0+deb12u1
15.14-0+deb12u1
15.15-0+deb12u1
15.16-0+deb12u1
15.17-0+deb12u1
15.18-0+deb12u1
15.19-0+deb12u1
Debian:13 / postgresql-17
Package
- Name
- postgresql-17
- Purl
- pkg:deb/debian/postgresql-17?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14 / postgresql-18
Package
- Name
- postgresql-18
- Purl
- pkg:deb/debian/postgresql-18?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
18~~devel.*
18~~devel.20250318+g4078da6c478-1
18~~devel.20250331-1
18~~devel.20250405-1
18~~devel.20250421-1
18~~devel.20250502-1
Other
18~beta1-1
18~beta1+20250612-1
18~beta1+20250624-1
18~beta1+20250701-1
18~beta2-1
18~beta3-1
18~rc1-1
18~rc1-2
18~rc1-3
18.*
18.0-1
18.1-1
18.1-2
18.2-1
18.3-1
18.4-1
18.6-1
18.6-2
18.6-3
18.7-1