Ethical Hacking News
PostgreSQL has patched 52 security vulnerabilities, including a 22-year-old bug that allows an attacker to execute arbitrary code on the server. Users are urged to take immediate action to patch their servers and protect themselves from these newly discovered security vulnerabilities.
PostgreSQL has been hit with 52 newly discovered security vulnerabilities, including a 22-year-old bug that allows arbitrary code execution. The vulnerabilities include issues with database security, composite type vulnerabilities, and client tool exploits. The 22-year-old bug, CVE-2026-6460, allows an attacker to execute malicious code with elevated privileges. The fix requires rebuilding or updating C-language extensions and version checks to detect incompatible value types. Users are urged to take immediate action to patch their servers and protect themselves from the newly discovered vulnerabilities.
The PostgreSQL community has been dealt a significant blow in the form of 52 newly discovered security vulnerabilities, including a particularly concerning 22-year-old bug that allows an attacker to execute arbitrary code on the server. The patches, released yesterday, address a wide range of issues, from database security flaws to composite type vulnerabilities that can be exploited by an attacker.
The PostgreSQL Global Development Group, which is responsible for maintaining the database, has issued a security advisory that highlights the severity of the vulnerabilities. The advisory warns that the 22-year-old bug, tracked as CVE-2026-6460, is particularly worrying, as it allows a database user who can create objects to run code on the server. This means that an attacker could potentially gain elevated privileges and execute malicious code, potentially leading to a significant security breach.
The bug, which has a CVSS score of 8.8, is related to composite types, which are types built from named fields, each with its own data type. The issue arises when a field's type is changed while older values of that type are still held in other parts of the server. This can lead to the server reading an old value as if it had the new type, potentially allowing an attacker to execute malicious code.
The fix for the bug, which adds version checks to the server, is designed to detect a value that no longer matches its type. However, it's worth noting that this fix requires rebuilding or updating every C-language extension at the same time as the server.
In addition to the 22-year-old bug, the patches address a wide range of other security vulnerabilities, including several issues related to client tools. These vulnerabilities can be exploited by an attacker to execute malicious code, potentially leading to a significant security breach.
The PostgreSQL community is urging all users to take immediate action to patch their servers, including updating to the latest version of the database and rebuilding or updating C-language extensions. The community is also warning that the 22-year-old bug is particularly concerning, as it allows an attacker to execute arbitrary code on the server.
The patches are available now, and users are urged to take the necessary steps to protect their servers from these newly discovered security vulnerabilities.
Related Information:
https://www.ethicalhackingnews.com/articles/PostgreSQL-Patches-52-Flaws-Including-a-22-Year-Old-Bug-Enabling-Authenticated-Remote-Code-Execution-ehn.shtml
https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html
https://nvd.nist.gov/vuln/detail/CVE-2026-6460
https://www.cvedetails.com/cve/CVE-2026-6460/
Published: Fri Nov 13 13:21:18 2026 by llama3.2 3B Q4_K_M
