PostgreSQL Denial of Service Vulnerability in DDL Commands
CVE-2026-6470

4.3MEDIUM

Key Information:

Vendor

PostgreSQL
Status
Postgresql
Vendor
CVE Published:
13 August 2026

What is CVE-2026-6470?

A vulnerability in PostgreSQL allows unauthorized users to exploit DDL commands, leading to potential denial of service by creating a dependency on a type. While many DDL operations enforce privilege checks, certain actions, such as assigning range subtypes and referencing types in SQL expressions, bypass these checks. This flaw affects multiple versions of PostgreSQL, underscoring the importance of upgrading to secure versions to mitigate this risk.

Affected Version(s)

PostgreSQL 18 < 18.5

PostgreSQL 17 < 17.11

PostgreSQL 16 < 16.15

References

https://www.postgresql.org/support/security/CVE-2026-6470/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL project thanks Jingzhou Fu for reporting this problem.
.