CVE-2026-2006 — Improper Validation of Array Index in Postgresql

CWE-129 — Improper Validation of Array IndexCWE-1285 — Improper Validation of Specified Index, Position, or Offset in InputCWE-347 — Improper Verification of Cryptographic Signature22 documents12 sources
Severity
8.8HIGHNVD
OSV4.3
EPSS
0.0%
top 90.32%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
PostgresqlDebian Postgresql-13Debian Postgresql-15+4 more
Timeline
PublishedFeb 12
Latest updateMar 19

Description

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

▶debiandebian/postgresql-13< postgresql-13 13.23-0+deb11u2 (bullseye)
▶debiandebian/postgresql-15< postgresql-13 13.23-0+deb11u2 (bullseye)
▶debiandebian/postgresql-17< postgresql-13 13.23-0+deb11u2 (bullseye)
▶debiandebian/postgresql-18< postgresql-13 13.23-0+deb11u2 (bullseye)
▶CVEListV5postgresql/postgresql18 — 18.2+4

🔴Vulnerability Details

5
OSV
postgresql-14, postgresql-16, postgresql-17 vulnerabilities↗2026-03-04
▶
GHSA
ENS DNSSEC Oracle Vulnerable to RSA Signature Forgery via Missing PKCS#1 v1.5 Padding Validation↗2026-02-25
▶
CVEList
PostgreSQL missing validation of multibyte character length executes arbitrary code↗2026-02-12
▶
GHSA
GHSA-mq5v-x68w-mc4f: Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer↗2026-02-12
▶
OSV
CVE-2026-2006: Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer↗2026-02-12
▶

📋Vendor Advisories

4
Ubuntu
PostgreSQL vulnerabilities↗2026-03-04
▶
Red Hat
postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code↗2026-02-12
▶
Debian
CVE-2026-2006: postgresql-13 - Missing validation of multibyte character length in PostgreSQL text manipulation...↗2026
▶
Apache
Apache httpd: CVE-2005-3357↗
▶

🕵️Threat Intelligence

8
Tenable
Marcus Ranum PaulDotCom Interview on Penetration Testing↗2008-12-14
▶
Wiz
CVE-2026-2004 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-3172 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-2003 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
Wiz
CVE-2026-2005 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶

💬Community

2
Bugzilla
CVE-2006-10003 perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files↗2026-03-19
▶
Bugzilla
CVE-2006-2026 security flaw↗2018-08-16
▶