CVE-2026-73515 PostGIS < 3.7.0beta2 Out-of-Bounds Read via FlatGeobuf Buffer
Attackers can cause memory disclosure or server crashes in PostGIS by supplying malformed FlatGeobuf buffers due to insufficient bounds checking.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73515?
CVE-2026-73515 is a high-severity vulnerability in PostGIS, published on 13 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
Weakness: CWE-125
Which versions are affected by CVE-2026-73515?
1 open source package ship an affected version, including postgis.
| Package | Affected | Fixed in |
|---|---|---|
postgis Bitnami | All versions | 3.7.0 |
Linux distribution packages (32)
postgis AlmaLinux:10 | All versions | 3.5.3-4.el10_2.1 |
postgis-client AlmaLinux:10 | All versions | 3.5.3-4.el10_2.1 |
postgis-docs AlmaLinux:10 | All versions | 3.5.3-4.el10_2.1 |
postgis-upgrade AlmaLinux:10 | All versions | 3.5.3-4.el10_2.1 |
postgis-utils AlmaLinux:10 | All versions | 3.5.3-4.el10_2.1 |
postgresql18-postgis AlmaLinux:10 | All versions | 3.5.3-1.el10_2.1 |
postgresql18-postgis-client AlmaLinux:10 | All versions | 3.5.3-1.el10_2.1 |
postgresql18-postgis-docs AlmaLinux:10 | All versions | 3.5.3-1.el10_2.1 |
postgresql18-postgis-upgrade AlmaLinux:10 | All versions | 3.5.3-1.el10_2.1 |
postgresql18-postgis-utils AlmaLinux:10 | All versions | 3.5.3-1.el10_2.1 |
postgis Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-client Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-client-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-docs Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-upgrade Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-upgrade-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgis-utils Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgresql16-postgis Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgresql16-postgis-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgresql16-postgis-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-4.el10_2.1 |
postgresql18-postgis Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-client Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-client-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-docs Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-upgrade Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-upgrade-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql18-postgis-utils Red Hat:enterprise_linux:10.2 | All versions | 0:3.5.3-1.el10_2.1 |
postgresql16-postgis Rocky Linux:10 | All versions | 0:3.5.3-4.el10_2.1 |
postgresql18-postgis Rocky Linux:10 | All versions | 0:3.5.3-1.el10_2.1 |
How do I fix CVE-2026-73515?
Upgrade postgis to 3.7.0 or later.
Is CVE-2026-73515 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-73515 exists.
Sources
Also known as ALSA-2026:65899, ALSA-2026:67166, BIT-postgis-2026-73515, DEBIAN-CVE-2026-73515, ECHO-b804-39cf-8307, GHSA-qv7r-wgc7-6mc6 and 6 more.