high CVSS 8.8 EPSS 0.37%

CVE-2026-6637·PostgreSQL vulnerability

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity
high
Software
PostgreSQL
Fixed in
18.4
Published

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.37% — higher than 29% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Read the two together. CVE-2026-6637 scores 8.8 on CVSS, so a successful attack would be serious — but at 0.37%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.

Affected versions

From: 18.0

Until: 18.4

Fixed in: 18.4

How to fix this CVE

Upgrade PostgreSQL to version 18.4 or later to patch a critical stack buffer overflow in the refint module that could allow unauthorized code execution. Organizations running versions 18.0 through 18.3 should prioritize this update, especially if the refint extension is installed or if user-controlled data is mapped to cascade primary keys. Test the upgrade in a non-production environment first to ensure application compatibility.

sudo dnf update postgresql postgresql-client postgresql-contrib

Defensia detects this vulnerability

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

WAF rules should block or require authentication for any SQL statements containing unusual stack manipulation patterns or unexpected CASCADE operations on primary keys. Monitor for multiple failed authentication attempts followed by queries targeting the refint extension.

How to check if you are affected

  1. Run 'SELECT version();' in psql to confirm your current PostgreSQL version number
  2. Execute 'SELECT * FROM pg_extension WHERE extname = 'refint';' to check if the vulnerable refint extension is loaded
  3. Review PostgreSQL logs for stack traces, segmentation faults, or unexpected process terminations that may indicate exploitation attempts
  4. After patching, run 'SELECT version();' again and verify the version is 18.4 or higher

FAQ

What is CVE-2026-6637?

This vulnerability is a stack buffer overflow in PostgreSQL's refint module that permits unprivileged database users to execute arbitrary code with the privileges of the database process. If user input is incorrectly handled in cascade primary key operations, attackers may also leverage SQL injection to escalate privileges.

Is CVE-2026-6637 being actively exploited?

No, CVE-2026-6637 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, and no public proof-of-concept exploits have been disclosed.

What versions of PostgreSQL are affected by CVE-2026-6637?

PostgreSQL versions 14.0 through 14.22, 15.0 through 15.17, 16.0 through 16.13, 17.0 through 17.9, and 18.0 through 18.3 are vulnerable. Versions 14.23, 15.18, 16.14, 17.10, and 18.4 or later contain the fix.

How do I check if my server is vulnerable to CVE-2026-6637?

Connect to your PostgreSQL instance and run 'SELECT version();' If the version is 18.0–18.3, you are vulnerable. Additionally, query 'SELECT * FROM pg_extension WHERE extname = 'refint';' to determine if the vulnerable module is enabled.

Does Defensia detect CVE-2026-6637?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If PostgreSQL is installed on a monitored server, CVE-2026-6637 will appear in your dashboard with remediation steps.

Related PostgreSQL CVEs

CVE-2026-15742CVSS 8.8Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670CVSS 8.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14669CVSS 8.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14671CVSS 8.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14664CVSS 8.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2026-6637. Free for 1 server.

Get started free