DSA-6438-1 postgresql-17 - security update

unknownCVE-2026-6471

Multiple security issues were discovered in PostgreSQL, which may result in execution of arbitrary code, incorrect authentication, information disclosure, or privilege escalation. The upstream fix to address CVE-2026-6471 requires additional changes to the configuration if some extensions are used. This affects the postgresql-17-wal2json, postgresql-17-squeeze, postgresql-17-pg-rewrite and postgresql-17-decoderbufs extensions included in Debian. Quoting from the changelog: | Restrict logical decoding output plugins to the set specified by | a new server parameter output_plugin_libraries (Jacob | Champion) | Previously, a replication user could select any loadable library | | Restrict logical decoding output plugins to the set specified by | a new server parameter output_plugin_libraries (Jacob | Champion) | Previously, a replication user could select any loadable library | for logical decoding, allowing exploits of various sorts. To | allow locking this down without breaking setups that worked | before, introduce a whitelist of allowed output plugins. | | By default, only the output plugins shipped as part of | PostgreSQL (pgoutput and test_decoding) are included in |output_plugin_libraries. Installations that rely on other | output plugins must add them after updating the server, for | example | | output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder' https://security-tracker.debian.org/tracker/DSA-6438-1

CSIRTS triage

vendor: PostgreSQL product: postgresql-17 Remote code execution Authentication bypass Information disclosure Privilege escalationaffected: 17

What: Multiple security issues in PostgreSQL 17 including arbitrary code execution, incorrect authentication, information disclosure, and privilege escalation via logical decoding output plugins.
Who is affected: PostgreSQL 17 deployments using logical decoding extensions including wal2json, squeeze, pg-rewrite, or decoderbufs on Debian.
Urgency: High; CVE-2026-6471 allows a replication user to select any loadable library, creating a code execution path that requires configuration changes to mitigate.
Action: Update postgresql-17 to the patched version and configure the new `output_plugin_libraries` parameter to restrict loadable libraries for logical decoding.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch postgresql-17

Get an email when a new postgresql-17 advisory drops — max one per day, one-click unsubscribe.

Details

Source: Debian Security Advisories (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-13
Exploitation: Not in CISA KEV at last sync

Original advisory: https://lists.debian.org/debian-security-announce/2026/msg00349.html

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-64710.51% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 41% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-6471	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

high[NEW] [high] PostgreSQL: Multiple vulnerabilitiescert-bund
unknownMultiple vulnerabilities in PostgreSQL (August 14, 2026)cert-fr-avis
highCVE-2026-6471: Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION…nvd