CVE-2026-14672

Name of the Vulnerable Software and Affected Versions PostgreSQL versions 16.0 through 16.14 PostgreSQL versions 17.0 through 17.10 PostgreSQL versions 18.0 through 18.4

Description A discrepancy in the responses of the SCRAM authentication subsystem allows an unauthenticated remote attacker to verify the existence of a user. This is achieved by observing the scram iterations count, as the system reports the default value for nonexistent users, whereas existing users may have a non-default count.

Recommendations Update PostgreSQL version 16 to 16.15. Update PostgreSQL version 17 to 17.11. Update PostgreSQL version 18 to 18.5.