CVE-2026-14663·PostgreSQL vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.10% — in the bottom 1% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

Upgrade PostgreSQL to version 18.6 or later to resolve a cryptographic weakness in the pgcrypto extension where disabled cipher algorithms may expose encrypted data. Organizations using pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, or their bytea variants should prioritize this update to restore proper encryption integrity and modification detection.

sudo dnf update postgresql-server postgresql-contrib

How to check if you are affected

1. Step 1: Check PostgreSQL version with: psql --version or SELECT version();
2. Step 2: Query for pgcrypto extension use: SELECT * FROM pg_extension WHERE extname = 'pgcrypto';
3. Step 3: Search PostgreSQL logs for pgp_sym_encrypt or pgp_pub_encrypt function calls: grep -i 'pgp_sym_encrypt\|pgp_pub_encrypt' /var/log/postgresql/postgresql.log
4. Step 4: After upgrade, confirm version with SELECT version(); and verify pgcrypto functions work without decryption errors

FAQ

Related PostgreSQL CVEs

References

• https://www.postgresql.org/support/security/CVE-2026-14663/