Home / mailings [SECURITY] [DSA 6438-1] postgresql-17 security update
Posted on 13 August 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6438-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
August 13, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : postgresql-17
CVE ID : CVE-2026-6464 CVE-2026-6469 CVE-2026-6470 CVE-2026-6471
CVE-2026-6473 CVE-2026-14662 CVE-2026-14663 CVE-2026-14664
CVE-2026-14666 CVE-2026-14668 CVE-2026-14669 CVE-2026-14670
CVE-2026-14671 CVE-2026-14672 CVE-2026-14673 CVE-2026-14677
CVE-2026-14678 CVE-2026-14679 CVE-2026-14680 CVE-2026-14681
CVE-2026-15741 CVE-2026-15742 CVE-2026-16239 CVE-2026-16241
CVE-2026-18024 CVE-2026-18408 CVE-2026-19385
Multiple security issues were discovered in PostgreSQL, which may
result in execution of arbitrary code, incorrect authentication,
information disclosure, or privilege escalation.
The upstream fix to address CVE-2026-6471 requires additional changes
to the configuration if some extensions are used. This affects the
postgresql-17-wal2json, postgresql-17-squeeze, postgresql-17-pg-rewrite
and postgresql-17-decoderbufs extensions included in Debian.
Quoting from the changelog:
| Restrict logical decoding output plugins to the set specified by
| a new server parameter `output_plugin_libraries` (Jacob
| Champion)
| Previously, a replication user could select any loadable library
|
| Restrict logical decoding output plugins to the set specified by
| a new server parameter `output_plugin_libraries` (Jacob
| Champion)
| Previously, a replication user could select any loadable library
| for logical decoding, allowing exploits of various sorts. To
| allow locking this down without breaking setups that worked
| before, introduce a whitelist of allowed output plugins.
|
| By default, only the output plugins shipped as part of
| PostgreSQL (`pgoutput` and `test_decoding`) are included in
|`output_plugin_libraries`. Installations that rely on other
| output plugins must add them after updating the server, for
| example
|
| output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder'
For the stable distribution (trixie), these problems have been fixed in
version 17.11-0+deb13u1.
We recommend that you upgrade your postgresql-17 packages.
For the detailed security status of postgresql-17 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/postgresql-17
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
