CVE-2026-6474

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6474", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-04-17T00:36:25.451Z", "datePublished": "2026-05-14T13:00:10.254Z", "dateUpdated": "2026-05-14T15:30:37.425Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-14T13:00:10.254Z"}, "title": "PostgreSQL timeofday() can disclose portions of server memory", "descriptions": [{"lang": "en", "value": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.4", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.10", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.14", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.18", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.23", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-134", "type": "CWE", "description": "Use of Externally-Controlled Format String"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6474/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Xint Code for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T15:30:17.967244Z", "id": "CVE-2026-6474", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:30:37.425Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6474", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T15:30:17.967244Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T15:30:34.525Z"}}], "cna": {"title": "PostgreSQL timeofday() can disclose portions of server memory", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Xint Code for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 4.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "18", "lessThan": "18.4", "versionType": "rpm"}, {"status": "affected", "version": "17", "lessThan": "17.10", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.14", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.18", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "14.23", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2026-6474/"}], "descriptions": [{"lang": "en", "value": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-134", "description": "Use of Externally-Controlled Format String"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-05-14T13:00:10.254Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6474", "state": "PUBLISHED", "dateUpdated": "2026-05-14T15:30:37.425Z", "dateReserved": "2026-04-17T00:36:25.451Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-05-14T13:00:10.254Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.4", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.10", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.14", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.18", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.23", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "C432AE18-DD50-40EB-B46A-9283F30081DA", "versionEndExcluding": "14.23", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "9D8D994F-ABAB-4AC2-992F-320F4868698D", "versionEndExcluding": "15.18", "versionStartIncluding": "15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "B58AE3D3-E1C9-45D2-AA92-A3D135B77A8A", "versionEndExcluding": "16.14", "versionStartIncluding": "16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "A19538E9-DBB9-4396-AC04-17943E82C411", "versionEndExcluding": "17.10", "versionStartIncluding": "17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*", "matchCriteriaId": "F8DB17ED-67AD-41F2-B272-27AF5B4FA2B0", "versionEndExcluding": "18.4", "versionStartIncluding": "18.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."}, {"lang": "es", "value": "Cadena de formato controlada externamente en la funci\u00f3n timeofday() de PostgreSQL permite a un atacante recuperar porciones de la memoria del servidor, a trav\u00e9s de zonas horarias manipuladas. Las versiones anteriores a PostgreSQL 18.4, 17.10, 16.14, 15.18 y 14.23 est\u00e1n afectadas."}], "id": "CVE-2026-6474", "lastModified": "2026-11-11T20:10:00.273", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6474", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T15:30:17.967244Z", "version": "2.0.3"}}]}, "published": "2026-05-14T14:16:24.997", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.postgresql.org/support/security/CVE-2026-6474/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-134"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function", "id": "2477441", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477441"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-134", "details": ["A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the `timeofday()` function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing confidential information."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-6474", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "postgresql16", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "postgresql18", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "postgresql:12/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "postgresql:13/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "postgresql:18/postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Fix deferred", "package_name": "postgresql18", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-05-14T13:00:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-6474\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-6474\nhttps://www.postgresql.org/support/security/CVE-2026-6474/"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[18,18.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[17,17.10)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[16,16.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15,15.18)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,14.23)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "inferred", "scores": [{"score": 85.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "PostgreSQL", "source": "cna", "vendor": "n/a"}, "product": "postgresql", "vendor": "postgresql"}], "created": "2026-05-14T14:45:22.433042+00:00", "updated": "2026-05-14T16:30:24.193445+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}