JLSEC-2026-52
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2026/JLSEC-2026-52.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2026/JLSEC-2026-52.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2026-52
- Upstream
- Published
- 2026-04-03T13:27:15.647Z
- Modified
- 2026-04-03T13:31:40.976065Z
- Summary
- [none]
- Details
-
Time-of-check Time-of-use (TOCTOU) race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack requires waiting for pg_dump to start, but winning the race condition is trivial if the attacker retains an open transaction. Versions before PostgreSQL 16.4, 15.8, 14.13, 13.16, and 12.20 are affected.
- Database specific
{ "license": "CC-BY-4.0", "sources": [ { "published": "2024-08-08T13:15:14.007Z", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2024-7348", "modified": "2024-11-21T09:51:20.720Z", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7348", "id": "CVE-2024-7348", "imported": "2026-04-03T13:13:10.515Z" } ] }- References