CVE-2026-6474: postgresql
CVSS: 4.3v3.1MediumAnalyzed
AliasesALPINE-CVE-2026-6474UBUNTU-CVE-2026-6474DEBIAN-CVE-2026-6474
Published 14-05-2026Last modified 14-05-2026
Vulnerability summary
CVE-2026-6474 is a medium (CVSS 4.3) vulnerability in postgresql. EPSS estimates a 0.21% chance of exploitation in the next 30 days, higher than 11% of scored vulnerabilities.
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.21%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 30 · Related 15MGASA-2026-0151OPENSUSE-SU-2026:10806-1OPENSUSE-SU-2026:10807-1OPENSUSE-SU-2026:10808-1OPENSUSE-SU-2026:10809-1OPENSUSE-SU-2026:10828-1OPENSUSE-SU-2026:20970-1OPENSUSE-SU-2026:21102-1OPENSUSE-SU-2026:21103-1OPENSUSE-SU-2026:21104-1RHSA-2026:22878RHSA-2026:26181RHSA-2026:26203RHSA-2026:26204RHSA-2026:26524RHSA-2026:26525RHSA-2026:26561RHSA-2026:27718RHSA-2026:27742RHSA-2026:27743RHSA-2026:28037RHSA-2026:28143RHSA-2026:32983RHSA-2026:33441RHSA-2026:33497SUSE-SU-2026:22077-1SUSE-SU-2026:22149-1SUSE-SU-2026:22177-1SUSE-SU-2026:22183-1SUSE-SU-2026:22184-1USN-8294-1
Timeline
- 14-05-2026PublishedVulnerability first disclosed.
- 14-05-2026Last modifiedVulnerability information updated.
Description
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.21%
Chance of exploitation in the next 30 days
Percentile
11%
Versus all other CVEs
30-day change
0.00 pp
From 0.21% on 19-09-2026
19-09-202619-10-2026
EPSS score0.21%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu8 products
- postgresql-10All versions (No fix recorded)
- postgresql-12All versions (No fix recorded)
- postgresql-14< 14.23-0ubuntu0.22.04.1
- postgresql-16< 16.14-0ubuntu0.24.04.1
- postgresql-17< 17.10-0ubuntu0.25.10.1
Alpine4 products
- postgresql15< 15.18-r0
- postgresql16< 16.14-r0
- postgresql17< 17.10-r0
- postgresql18< 18.4-r0
Debian3 products
- postgresql-15< 15.18-0+deb12u1
- postgresql-17< 17.10-0+deb13u1
- postgresql-18< 18.4-1
Postgresql1 product
- postgresql< 14.23 | ≥ 15.0, < 15.18 | ≥ 16.0, < 16.14 | ≥ 17.0, < 17.10 | ≥ 18.0, < 18.4
4 vendors · 16 products
