PostgreSQL 17.10 and 15.18 on Debian: May 2026 security update (DSA-6270-1, DSA-6269-1)

On 14 May 2026 Debian published DSA-6270-1 for postgresql-17 in Debian 13 (trixie) and DSA-6269-1 for postgresql-15 in Debian 12 (bookworm). They moved Debian to PostgreSQL 17.10 and 15.18, which fix up to ten CVEs in the server, a contrib module, libpq and the backup tools. This page explains those fixes and the earlier February 2026 update; a later release in August 2026 builds on both.

At a glance

What the vulnerabilities are

Debian describes the May issues as ones that may result in authorisation bypass, execution of arbitrary code, information disclosure, privilege escalation, SQL injection or denial of service. The upstream PostgreSQL release of 14 May 2026 (18.4, 17.10, 16.14, 15.18, 14.23) fixed 11 vulnerabilities and over 60 bugs. The ones that matter most for a typical server:

• Code execution inside the database server. CVE-2026-6637 is a stack buffer overflow and SQL injection in the refint contrib module that could let an unprivileged database user run code as the operating-system user running PostgreSQL. CVE-2026-6473 covers integer wraparound in memory-allocation sizes. Both are rated 8.8.
• Denial of service before login. CVE-2026-6479 (7.5) is uncontrolled recursion during SSL and GSS negotiation. The CVE record notes that an attacker able to connect to the Unix socket can cause a sustained denial of service, and with SSL and GSS both disabled the same is possible over TCP.
• Malicious server against client tools. CVE-2026-6477 lets a server superuser overwrite client stack memory through libpq's large-object functions, and CVE-2026-6475 lets the origin superuser make pg_basebackup (plain format) or pg_rewind overwrite local files. Both are 8.8 and matter when you connect to or copy from a server you do not fully control.
• Smaller issues. A timing side channel that may disclose MD5-hashed passwords (CVE-2026-6478, 6.5), a missing privilege check in CREATE TYPE (CVE-2026-6472) and a memory disclosure through timeofday() (CVE-2026-6474). Two further issues, CVE-2026-6476 in pg_createsubscriber and CVE-2026-6638 in REFRESH PUBLICATION, affect PostgreSQL 17 only.

The February 2026 advisories (DSA-6133-1 and DSA-6132-1, 12 February) fixed four CVEs that Debian said may result in memory disclosure or the execution of arbitrary code, including CVE-2026-2006 (multibyte character length validation, 8.8) and CVE-2026-2005 (pgcrypto heap buffer overflow, 8.8). None of the CVEs on this page is in CISA's Known Exploited Vulnerabilities catalog.

Are you affected?

Any Debian 13 server below 17.10-0+deb13u1 or Debian 12 server below 15.18-0+deb12u1 is missing these fixes. Check the server, client and library packages:

dpkg -l 'postgresql*' libpq5 | grep '^ii'
apt policy postgresql-17 libpq5   # Debian 13
apt policy postgresql-15 libpq5   # Debian 12

Because CVE-2026-6477 and CVE-2026-6475 sit in libpq and the backup tools, machines that only run pg_basebackup, pg_rewind or applications linked to libpq5 need the update too.

How to update

Debian's archive now carries newer PostgreSQL packages that include all of these fixes, so a normal upgrade brings you fully up to date:

sudo apt update
sudo apt upgrade

Since August 2026 the current packages are 17.11 for trixie (DSA-6438-1) and, for bookworm, 15.19 published as an LTS advisory (DLA-4740-1), because Debian 12's regular support ended in July 2026. The August release also asks some users to set a new output_plugin_libraries parameter, so read its notes before you upgrade a replication setup.

Restart or reboot?

No reboot is needed. Check that each cluster is running the new binaries after the upgrade:

pg_lsclusters
sudo -u postgres psql -c 'SELECT version();'

Restart a cluster that still shows an old version with sudo systemctl restart postgresql@17-main (adjust version and name). Restart application services that load libpq5; sudo needrestart lists them. The 17.10 and 15.18 release notes list no extra post-update steps for upgrades from 17.6 or 15.14 and later.

Sources

• security-tracker.debian.org/tracker/DSA-6270-1
• debian.org/security/2026/dsa-6270
• lists.debian.org/debian-security-announce/2026/msg00181.html
• security-tracker.debian.org/tracker/DSA-6269-1
• debian.org/security/2026/dsa-6269
• lists.debian.org/debian-security-announce/2026/msg00180.html
• security-tracker.debian.org/tracker/DSA-6133-1
• lists.debian.org/debian-security-announce/2026/msg00042.html
• security-tracker.debian.org/tracker/DSA-6132-1
• lists.debian.org/debian-security-announce/2026/msg00041.html
• postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297
• postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235
• postgresql.org/support/security
• postgresql.org/docs/release/17.10
• postgresql.org/docs/release/15.18
• cve.org/CVERecord?id=CVE-2026-6479
• cve.org/CVERecord?id=CVE-2026-6477
• cve.org/CVERecord?id=CVE-2026-6475
• cve.org/CVERecord?id=CVE-2026-6637
• cve.org/CVERecord?id=CVE-2026-2006
• security-tracker.debian.org/tracker/DSA-6438-1
• security-tracker.debian.org/tracker/DLA-4740-1
• debian.org/releases
• cisa.gov/known-exploited-vulnerabilities-catalog