Vulnerability · high
PostgreSQL 18.7 Debian and Red Hat packages handled to protect users
Tier B · Patch this week – Put it in the sprint
Who’s exposed: PostgreSQL servers where users can create objects, plus C extensions
Tier B because: Full takeover OR secrets exposed OR supply chain
Reach
Attack
Damage
Fix
Popular tool · Full takeover
What to do
- Upgrade PostgreSQL to the released update, 18.7 for the 18 branch
- Rebuild any C-language extensions installed on the server
The Brief
- PostgreSQL released updates on 2026-11-12 that fix 52 security flaws.
- A 22-year-old type confusion flaw lets a database user who can create objects run code on the server.
- Full protection from the type confusion flaw also requires rebuilding any C-language extensions installed on the server.
- Planet PostgreSQL reports that Debian and Red Hat packages of Postgres 18.7 were also handled to protect users.
Why it matters
If untrusted or low-privilege users can create objects on your PostgreSQL server, they may be able to run code on it. Updating alone is not enough when C-language extensions are installed, because they must be rebuilt too.
The checklist behind the tier
Checklist · 3 of 10 yes
| Yes | Hits tech teams | Judgment: PostgreSQL is a database that developers and ops teams build with and run. |
| No | Core infrastructure | Judgment: PostgreSQL is widely used but is not core infrastructure like OpenSSH, the Linux kernel or OpenSSL. |
| Yes | Popular tool | Judgment: PostgreSQL is a mainstream, widely deployed database used by many teams. |
| No | Exploited in the wild | The Hacker News: flaw is described as enabling authenticated RCE; no source reports observed attacks. |
| No | Public exploit | No source says exploit code or a step-by-step proof-of-concept has been published. |
| No | Remote, no login | The Hacker News: attacker must be a database user who can create objects, so credentials are needed. |
| Yes | Full takeover | The Hacker News: type confusion flaw lets a database user run code on the server, which is RCE. |
| No | Secrets exposed | No source reports credentials, data or configs being stolen or exposed. |
| No | Supply chain | No source reports malicious code shipped through packages, updates or build pipelines. |
| No | No fix yet | The Hacker News: updates released yesterday fix the flaw; rebuilding extensions is a follow-up step, not a missing fix. |
Timeline
PostgreSQL updates released fixing 52 security flaws, including the type confusion bug
Planet PostgreSQL
Jeremy Schneider: Postgres 18.7 Debian and Redhat Packagers Protect You
The Hacker News
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
Full coverage · 2 sources
First seen · 2 sources · Full story page · How tiers are decided