Loading vulnerability…
Stack Buffer Overflow and SQL Injection in PostgreSQL refint
CVE-2026-6637 affects PostgreSQL's refint module. The check_foreign_key() function constructs SQL queries using fixed-length buffers and insufficiently quoted key values, enabling stack buffer overflow and SQL injection. The buffer overflow allows an unprivileged database user to execute arbitrary code as the operating system account running PostgreSQL. A distinct SQL injection attack is possible when an application declares a user-controlled column as a refint cascade primary key and permits user-controlled updates to it; an attacker supplying the update value can execute arbitrary SQL as the database user performing the update. Affected releases precede PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 within their respective branches.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful buffer-overflow exploitation compromises the PostgreSQL server process with the privileges of its operating system account, potentially allowing access to or modification of database data and other resources accessible to that account, as well as service disruption. The separate SQL injection attack permits arbitrary SQL execution with the privileges of the database user performing the primary key update, potentially crossing application-level authorization boundaries. Confidentiality, integrity, and availability impacts are rated high.
If you can’t patch tonight, do this now.
Where an immediate upgrade is not possible, remove or disable use of the contrib/spi refint module where operationally feasible. Do not expose refint-triggered operations to untrusted database users; restrict permissions to create, alter, or invoke affected triggers and tables. Avoid application designs that permit user-controlled values to update a refint cascade primary key, and enforce parameterized SQL and input validation in application paths that perform such updates.
Patch, then assume compromise.
Upgrade PostgreSQL to version 18.4, 17.10, 16.14, 15.18, or 14.23, or a later fixed release in the corresponding branch. For vendor-bundled PostgreSQL deployments, apply the product vendor's security update containing the fix. Affected F5 BIG-IP Next for Kubernetes versions 2.0.0 through 2.2.1 and 2.3.0 should be upgraded to 2.2.2 or 2.3.1, as applicable; the affected component is License proxy.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
56 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.