CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands
Attackers can execute arbitrary psql commands by triggering early COPY failures, requiring control over server errors and data rows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6464?
CVE-2026-6464 is a high-severity code injection vulnerability in Postgresql Postgresql, published on 13 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Weakness: CWE-829
Which versions are affected by CVE-2026-6464?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 14.24.0, 15.19.0, 16.15.0, 17.11.0, 18.5.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-6464?
Upgrade postgresql to a fixed version for your release line: 14.24.0, 15.19.0, 16.15.0 or 17.11.0.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-6464 being exploited?
There is no known exploitation of CVE-2026-6464 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-6464, AZL-95741, BELL-CVE-2026-6464, BIT-postgresql-2026-6464, DEBIAN-CVE-2026-6464, ECHO-930d-ab3a-f99c and 9 more.