CVE-2026-6464

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24

Description Untrusted data inclusion in psql COPY may allow a server administrator to trigger the execution of data lines as psql commands through error injection. This occurs if the COPY FROM STDIN or copy FROM STDIN commands fail before the server indicates it is awaiting input rows, causing psql to process the in-line data rows as commands. A successful attack requires the attacker to control both the server and the data rows, or for an attacker controlling only the data rows to benefit from a coincidental error. The COPY FROM command using a filename is not affected.

Recommendations Update to version 18.5 or later. Update to version 17.11 or later. Update to version 16.15 or later. Update to version 15.19 or later. Update to version 14.24 or later.