CVE-2026-2004

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2004", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-02-05T18:17:54.681Z", "datePublished": "2026-02-12T13:00:08.857Z", "dateUpdated": "2026-07-15T01:20:56.958Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-12T13:00:08.857Z"}, "title": "PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code", "descriptions": [{"lang": "en", "value": "Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.2", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.8", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.12", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.16", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.21", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1287", "type": "CWE", "description": "Improper Validation of Specified Type of Input"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-2004/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "configurations": [{"lang": "en", "value": "Attacker has permission to install a vulnerable extension, e.g. intarray. Alternatively, a vulnerable extension is already installed, and the attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T04:56:33.418080Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:44:21.641Z"}}, {"affected": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1", "cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "postgresql16", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_1", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "postgresql18", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:18.3-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "postgresql16", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227180702.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227221316.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227221401.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260302082007.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.2"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8020020260309120440.4cda2c84", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260305144728.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260306101701.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260305144728.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260306101701.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123717.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123049.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123717.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123049.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260306092921.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-2.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260227094950.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260227095951.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_0.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9020020260309133405.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_4.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260306102041.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260305163703.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260309125703.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260305153549.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "postgresql18-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "18.3-1.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/rhua-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1773670137", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:18/postgresql", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "datePublic": "2026-02-12T13:00:08.857Z", "descriptions": [{"lang": "en", "value": "A type validation flaw has been discovered in PostgreSQL. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database."}], "metrics": [{"other": {"content": {"namespace": "https://access.redhat.com/security/updates/classification/", "value": "Important"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1287", "description": "Improper Validation of Specified Type of Input", "lang": "en", "type": "CWE"}]}], "references": [{"tags": ["vdb-entry", "x_refsource_REDHAT"], "url": "https://access.redhat.com/security/cve/CVE-2026-2004"}, {"name": "RHBZ#2439325", "tags": ["issue-tracking", "x_refsource_REDHAT"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439325"}, {"tags": ["x_sadp-csaf-vex"], "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2004.json"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4441"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3887"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19010"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:19009"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4064"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4024"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4059"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4063"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4506"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4509"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4504"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4505"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4516"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4075"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4074"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4515"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4518"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4254"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4475"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4548"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4544"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4524"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4546"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4547"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4528"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3896"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4110"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:3730"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:8756"}, {"tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2026:4943"}], "solutions": [{"lang": "en", "value": "RHSA-2026:4441: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)"}, {"lang": "en", "value": "RHSA-2026:3887: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:19010: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:19009: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)"}, {"lang": "en", "value": "RHSA-2026:4064: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:4024: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:4059: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:4063: Red Hat Enterprise Linux AppStream (v. 8)"}, {"lang": "en", "value": "RHSA-2026:4506: Red Hat Enterprise Linux AppStream AUS (v. 8.2)"}, {"lang": "en", "value": "RHSA-2026:4509: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:4504: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)"}, {"lang": "en", "value": "RHSA-2026:4505: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:4516: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream E4S (v.8.6), Red Hat Enterprise Linux AppStream TUS (v.8.6)"}, {"lang": "en", "value": "RHSA-2026:4075: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:4074: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:4515: Red Hat Enterprise Linux AppStream E4S (v.8.8)"}, {"lang": "en", "value": "RHSA-2026:4518: Red Hat Enterprise Linux AppStream E4S (v.9.0)"}, {"lang": "en", "value": "RHSA-2026:4254: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:4475: Red Hat Enterprise Linux AppStream E4S (v.9.2)"}, {"lang": "en", "value": "RHSA-2026:4548: Red Hat Enterprise Linux AppStream EUS (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:4544: Red Hat Enterprise Linux AppStream EUS (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:4524: Red Hat CodeReady Linux Builder EUS (v.9.4), Red Hat Enterprise Linux AppStream EUS (v.9.4)"}, {"lang": "en", "value": "RHSA-2026:4546: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:4547: Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:4528: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6)"}, {"lang": "en", "value": "RHSA-2026:3896: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:4110: Red Hat Enterprise Linux AppStream (v. 9)"}, {"lang": "en", "value": "RHSA-2026:3730: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)"}, {"lang": "en", "value": "RHSA-2026:8756: Red Hat Hardened Images"}, {"lang": "en", "value": "RHSA-2026:4943: Red Hat Update Infrastructure 5"}], "timeline": [{"lang": "en", "time": "2026-02-12T14:01:31.249Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2026-02-12T13:00:08.857Z", "value": "Made public."}], "title": "postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_adpType": "supplier", "x_generator": {"engine": "sadp-cli 1.0.0"}, "providerMetadata": {"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "shortName": "redhat-SADP", "dateUpdated": "2026-07-15T01:20:56.958Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2004", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-13T04:56:33.418080Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-12T14:32:49.462Z"}}], "cna": {"title": "PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "18", "lessThan": "18.2", "versionType": "rpm"}, {"status": "affected", "version": "17", "lessThan": "17.8", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.12", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.16", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "14.21", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-2004/"}], "descriptions": [{"lang": "en", "value": "Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1287", "description": "Improper Validation of Specified Type of Input"}]}], "configurations": [{"lang": "en", "value": "Attacker has permission to install a vulnerable extension, e.g. intarray. Alternatively, a vulnerable extension is already installed, and the attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-02-12T13:00:08.857Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2004", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:44:21.641Z", "dateReserved": "2026-02-05T18:17:54.681Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-02-12T13:00:08.857Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.2", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.8", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.12", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.16", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.21", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}, {"affectedData": [{"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.1", "cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "postgresql16", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_1", "versionType": "rpm"}, {"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:10.2"], "defaultStatus": "affected", "packageName": "postgresql18", "product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:18.3-1.el10_2", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux_eus:10.0"], "defaultStatus": "affected", "packageName": "postgresql16", "product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:16.13-1.el10_0", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227180702.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227221316.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260227221401.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8100020260302082007.489197e6", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.2"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8020020260309120440.4cda2c84", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260305144728.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.4"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260306101701.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260305144728.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus_long_life:8.4"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8040020260306101701.522a0ee4", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_aus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.6"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260306113941.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.6"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8060020260309111524.ad008a3a", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123717.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_tus:8.8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123049.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:13", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123717.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:12", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260302123049.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:8.8"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "8080020260306092921.63b34585", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-2.el9_7", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260227094950.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9070020260227095951.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.0"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_0.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9020020260309133405.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_e4s:9.2"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_2.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_4.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260306102041.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.4"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.4 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9040020260305163703.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "0:13.23-1.el9_6.1", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql:15", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260309125703.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhel_eus:9.6"], "defaultStatus": "affected", "packageName": "postgresql:16", "product": "Red Hat Enterprise Linux 9.6 Extended Update Support", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "9060020260305153549.rhel9", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:hummingbird:1"], "defaultStatus": "affected", "packageName": "postgresql18-main", "product": "Red Hat Hardened Images", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "18.3-1.2.hum1", "versionType": "rpm"}]}, {"collectionURL": "https://catalog.redhat.com/software/containers/", "cpes": ["cpe:/a:redhat:rhui:5::el9"], "defaultStatus": "affected", "packageName": "rhui5/rhua-rhel9", "product": "Red Hat Update Infrastructure 5", "vendor": "Red Hat", "versions": [{"lessThan": "*", "status": "unaffected", "version": "1773670137", "versionType": "rpm"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:6"], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 6", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:7"], "defaultStatus": "unknown", "packageName": "postgresql", "product": "Red Hat Enterprise Linux 7", "vendor": "Red Hat"}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/o:redhat:enterprise_linux:9"], "defaultStatus": "affected", "packageName": "postgresql:18/postgresql", "product": "Red Hat Enterprise Linux 9", "vendor": "Red Hat"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BCEAB7B-E4FC-4F9F-A1F9-62EA7DD6D6CC", "versionEndExcluding": "14.21", "versionStartIncluding": "14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "4B408DAF-2DCD-45FE-94EE-BC84947A41C8", "versionEndExcluding": "15.16", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "6353A59B-FE67-4DD5-B0E6-C10F0D2358D0", "versionEndExcluding": "16.12", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "E2CCF450-C726-403A-975F-B5717E92A769", "versionEndExcluding": "17.8", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "6B872502-5316-4E79-8FA1-24E5D8222C39", "versionEndExcluding": "18.2", "versionStartIncluding": "18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected."}, {"lang": "es", "value": "Falta de validaci\u00f3n del tipo de entrada en la funci\u00f3n estimadora de selectividad de la extensi\u00f3n intarray de PostgreSQL permite a un creador de objetos ejecutar c\u00f3digo arbitrario como el usuario del sistema operativo que ejecuta la base de datos. Las versiones anteriores a PostgreSQL 18.2, 17.8, 16.12, 15.16 y 14.21 est\u00e1n afectadas."}], "id": "CVE-2026-2004", "lastModified": "2026-07-15T02:19:25.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2004", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-13T04:56:33.418080Z", "version": "2.0.3"}}]}, "published": "2026-02-12T14:16:02.213", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Vendor Advisory"], "url": "https://www.postgresql.org/support/security/CVE-2026-2004/"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19009"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:19010"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3730"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3887"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:3896"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4024"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4059"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4063"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4064"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4074"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4075"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4110"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4254"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4441"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4475"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4504"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4505"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4506"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4509"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4515"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4516"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4518"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4524"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4528"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4544"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4546"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4547"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4548"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:4943"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/errata/RHSA-2026:8756"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://access.redhat.com/security/cve/CVE-2026-2004"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439325"}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2004.json"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1287"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-1287"}], "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code", "id": "2439325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439325"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1287", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-2004", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "postgresql16", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "postgresql18", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:12/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:13/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-12T13:00:08Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-2004\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-2004\nhttps://www.postgresql.org/support/security/CVE-2026-2004/"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.12)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.16)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.21)"}}], "product": "postgresql", "vendor": "postgresql"}], "analysis": {"en": {"generated_at": "2026-04-17T20:05:43.228161+00:00", "value": {"mitigation_remediation": ["Upgrade to PostgreSQL 18.2, 17.8, 16.12, 15.16, 14.21 or a newer release that includes the patched intarray implementation.", "If an upgrade cannot be performed immediately, disable or remove the intarray extension until a patch is applied, or limit creation of extensions and functions to highly trusted users.", "After applying the patch, review and restrict database roles so that only necessary users retain object\u2011creation privileges, and audit for any misuse of the intarray extension."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Affected products are PostgreSQL database releases before 18.2, 17.8, 16.12, 15.16 and 14.21, covering eleven major releases. The vulnerability is present in the intarray extension as shipped with these versions and persists until the specified patch levels. Administrators using any of the listed versions should consider their system impacted.", "description_and_impact": "The PostgreSQL intarray extension includes a selectivity estimator that improperly accepts arbitrary input types, unvalidated. This flaw permits an object creator\u2014a user with permissions to create objects within the database\u2014to supply malicious data that triggers the estimator and ultimately leads to arbitrary code execution under the operating system user running PostgreSQL. The flaw represents a classic input\u2011validation weakness (CWE\u20111287) and results in full control over the host where the database server runs. The likely attack vector is an object creator with appropriate privileges within the database.", "risk_and_exploitability": "The base CVSS score of 8.8 indicates high severity, yet the EPSS score of less than one percent suggests that current exploit activity is low but not impossible. The vulnerability is not listed in CISA\u2019s KEV catalog. Exploitation requires the attacker to act as an object creator within the database, a role typically granted to administrators but potentially reachable by privilege\u2011escalation attacks. Because the code runs with the operating\u2011system user privileges of PostgreSQL, successful exploitation results in full account compromise of that OS user."}}}}, "created": "2026-02-13T21:35:40.137264+00:00", "updated": "2026-04-17T20:15:26.996357+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}