Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
⚠️ Vulnerabilidades en productos PostgreSQL ❗ CVE-2026-6477 ❗ CVE-2026-6475 ❗ CVE-2026-6473 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-postgresql-2/ https://t.co/yHbC0kfr1p
Post summary
The post lists three new PostgreSQL CVEs and directs readers to a CERT page for additional information, but it does not provide exploit details, patches, or evidence of active exploitation.
⚠️ HIGH — CVE-2026-6477 Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lse… CVSS 8.8 Full analysis → https://sec.kaitan.id/cves/CVE-2026-6477 #PostgreSQL #CyberSecurity #InfoSec
Post summary
The post announces a high‑severity PostgreSQL vulnerability (CVE‑2026‑6477), provides brief technical details, and links to a full analysis.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | postgresql | postgresql | - | - | - |