Vulnerability · Published Aug 13, 2026 · Assigned by PostgreSQL

CVE-2026-14677PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound

High 8.8

In plain English

A high-severity integer overflow in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.4%top 64.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8pg_repack1.4.6-3.module_el8.9.0+3704+f1f917ceALSA-2026:69924
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4125+ceaf7d1bALSA-2026:69876
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8pg_repack1.5.1-1.module_el8.10.0+4199+bf03c564ALSA-2026:69876
AlmaLinux:8pg_repack1.4.8-1.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:9pg_repack1.5.1-1.module_el9.6.0+146+c54fdecaALSA-2026:67491
AlmaLinux:9pg_repack1.5.3-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9pg_repack1.4.8-2.module_el9.5.0+119+18833d03ALSA-2026:69914
AlmaLinux:8pgaudit1.4.0-7.module_el8.9.0+3740+0e74851f.alma.1ALSA-2026:69924
AlmaLinux:8pgaudit16.0-1.module_el8.10.0+3798+606ebb9fALSA-2026:69876
AlmaLinux:8pgaudit1.4.0-7.module_el8.10.0+3889+48cb11fb.alma.1ALSA-2026:69924
AlmaLinux:8pgaudit1.7.0-1.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:9pgaudit16.0-1.module_el9.4.0+66+eb9878bcALSA-2026:67491
AlmaLinux:9pgaudit1.7.0-1.module_el9.3.0+52+21733919ALSA-2026:69914
AlmaLinux:9pgaudit18.0-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9pgvector0.6.2-2.module_el9.6.0+167+4e561146ALSA-2026:67491
AlmaLinux:9pgvector0.8.1-1.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9postgis3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-client3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-client3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-docs3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-docs3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-upgrade3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgis-upgrade3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-utils3.5.3-6.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgis-utils3.6.1-4.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:8postgres-decoderbufs1.9.7-1.Final.module_el8.9.0+3706+885c732eALSA-2026:69923
AlmaLinux:8postgres-decoderbufs2.4.0-1.Final.module_el8.10.0+3798+606ebb9fALSA-2026:69876
AlmaLinux:8postgres-decoderbufs0.10.0-2.module_el8.9.0+3704+f1f917ceALSA-2026:69924
AlmaLinux:9postgres-decoderbufs2.4.0-1.Final.module_el9.4.0+66+eb9878bcALSA-2026:67491
AlmaLinux:9postgres-decoderbufs3.3.1-1.Final.module_el9.8.0+234+5456f35dALSA-2026:67848
AlmaLinux:9postgres-decoderbufs1.9.7-1.Final.module_el9.3.0+52+21733919ALSA-2026:69914
AlmaLinux:10postgresql16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql-contrib16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-contrib12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-contrib15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-contrib16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-contrib13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-contrib18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-contrib15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-contrib16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-docs16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-docs12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-docs16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-docs15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-docs15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-docs18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-docs16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-docs13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-plperl16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-plperl16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-plperl15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-plperl12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-plperl13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-plperl16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-plperl15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-plperl18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql-plpython316.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-plpython315.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-plpython316.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-plpython312.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-plpython315.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-plpython313.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-plpython318.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-plpython316.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-pltcl16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-pltcl15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-pltcl12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-pltcl16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-pltcl13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-pltcl16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-pltcl15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-pltcl18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:10postgresql-private-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-private-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-private-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-private-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-private-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-private-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-private-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-private-libs16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-private-libs16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-private-libs15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-private-libs15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-private-libs13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-private-libs18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-private-libs16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-server16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-server15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-server16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-server12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:9postgresql-server15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-server18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-server16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-server13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-server-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-server-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-server-devel12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-server-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-server-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-server-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-server-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-server-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:10postgresql-static16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-static12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-static15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-static16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-static15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-static18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-static13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-static16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-test16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-test12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-test15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-test16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-test18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-test16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-test13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-test15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql-test-rpm-macros16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-test-rpm-macros12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-test-rpm-macros15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:8postgresql-test-rpm-macros16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:9postgresql-test-rpm-macros13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-test-rpm-macros15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:9postgresql-test-rpm-macros18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-test-rpm-macros16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:10postgresql-upgrade16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-upgrade16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-upgrade12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-upgrade15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-upgrade18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-upgrade13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-upgrade16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-upgrade15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql-upgrade-devel16.15-1.el10_2ALSA-2026:70186
AlmaLinux:8postgresql-upgrade-devel12.22-10.module_el8.10.0+4290+614f71e9ALSA-2026:69924
AlmaLinux:8postgresql-upgrade-devel16.15-1.module_el8.10.0+4286+3c445f53ALSA-2026:69876
AlmaLinux:8postgresql-upgrade-devel15.19-1.module_el8.10.0+4287+eeacefccALSA-2026:69923
AlmaLinux:9postgresql-upgrade-devel18.6-1.module_el9.8.0+310+22372bccALSA-2026:67848
AlmaLinux:9postgresql-upgrade-devel13.23-6.el9_8ALSA-2026:69607
AlmaLinux:9postgresql-upgrade-devel16.15-1.module_el9.8.0+311+c39b793bALSA-2026:67491
AlmaLinux:9postgresql-upgrade-devel15.19-1.module_el9.8.0+318+764e137cALSA-2026:69914
AlmaLinux:10postgresql1818.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-contrib18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-docs18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-plperl18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-plpython318.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-private-devel18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-private-libs18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-server18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-server-devel18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-static18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-test18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-test-rpm-macros18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-upgrade18.6-1.el10_2ALSA-2026:67280
AlmaLinux:10postgresql18-upgrade-devel18.6-1.el10_2ALSA-2026:67280
Alpine:v3.21postgresql1515.19-r0ALPINE-CVE-2026-14677
Alpine:v3.22postgresql1515.19-r0ALPINE-CVE-2026-14677
Alpine:v3.21postgresql1616.15-r0ALPINE-CVE-2026-14677
Alpine:v3.22postgresql1616.15-r0ALPINE-CVE-2026-14677
Alpine:v3.23postgresql1616.15-r0ALPINE-CVE-2026-14677
Alpine:v3.24postgresql1616.15-r0ALPINE-CVE-2026-14677
Alpine:v3.21postgresql1717.11-r0ALPINE-CVE-2026-14677
Alpine:v3.22postgresql1717.11-r0ALPINE-CVE-2026-14677
Alpine:v3.23postgresql1717.11-r0ALPINE-CVE-2026-14677
Alpine:v3.24postgresql1717.11-r0ALPINE-CVE-2026-14677
Alpine:v3.23postgresql1818.5-r0ALPINE-CVE-2026-14677
Alpine:v3.24postgresql1818.5-r0ALPINE-CVE-2026-14677
Debian:12postgresql-1515.19-0+deb12u1DEBIAN-CVE-2026-14677
Debian:13postgresql-1717.11-0+deb13u1DEBIAN-CVE-2026-14677
Debian:14postgresql-1818.6-1DEBIAN-CVE-2026-14677
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+1862+29bef648RLSA-2026:69924
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+1900+d7340343RLSA-2026:69876
Rocky Linux:8pg_repack0:1.5.1-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:69876
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+40056+df351139RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.9.0+1525+fc91df60RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1622+bd25b19cRLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.8-1.module+el8.10.0+1858+fcc46a79RLSA-2026:69923
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.10.0+40055+b85d5ce2RLSA-2026:69924
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1594+4a6adae9RLSA-2026:69924
Rocky Linux:8pg_repack0:1.4.6-3.module+el8.9.0+1603+444d1b54RLSA-2026:69924
Rocky Linux:9pg_repack0:1.5.3-1.module+el9.8.0+40158+490b3c67RLSA-2026:67848
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.8.0+40159+adcaa225RLSA-2026:67491
Rocky Linux:9pg_repack0:1.5.1-1.module+el9.8.0+40212+d6f50005RLSA-2026:67491
Rocky Linux:9pg_repack0:1.4.8-2.module+el9.7.0+40011+28af63c9RLSA-2026:69914
Rocky Linux:9pg_repack0:1.5.3-1.module+el9.8.0+40213+f1e225a4RLSA-2026:67848
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.10.0+40056+df351139RLSA-2026:69923
Rocky Linux:8pgaudit0:1.7.0-1.module+el8.9.0+1525+fc91df60RLSA-2026:69923
Rocky Linux:8pgaudit0:1.4.0-7.module+el8.9.0+1735+a332307bRLSA-2026:69924
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+40057+c37a0e3dRLSA-2026:69876
Rocky Linux:8pgaudit0:16.0-1.module+el8.10.0+1622+bd25b19cRLSA-2026:69876

Affected products (as reported)

VendorProductVersions
n/a PostgreSQL 18 – before 18.617 – before 17.1116 – before 16.1515 – before 15.190 – before 14.24

Weakness: CWE-190 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References