CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound
An unprivileged user can trigger an integer wraparound to cause out-of-bounds writes, potentially executing arbitrary code or crashing the server.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6473?
CVE-2026-6473 is a high-severity vulnerability in Postgresql Postgresql, published on 14 May 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Weakness: CWE-190
Which versions are affected by CVE-2026-6473?
1 open source package ship an affected version, including postgresql. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
postgresql Bitnami | All versions | 14.23.0, 15.18.0, 16.14.0, 17.10.0, 18.4.0 |
Products include Postgresql Postgresql.
How do I fix CVE-2026-6473?
Upgrade postgresql to a fixed version for your release line: 14.23.0, 15.18.0, 16.14.0 or 17.10.0.
Is CVE-2026-6473 being exploited?
There is no known exploitation of CVE-2026-6473 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as ALPINE-CVE-2026-6473, AZL-86822, BELL-CVE-2026-6473, BIT-postgresql-2026-6473, CLSA-2026-1779465604, CLSA-2026-1779465893 and 13 more.