PostgreSQL Ships 11 CVEs Including RCE in refint Module

Anyone who has run a Postgres primary behind a payments service knows the dread of a security advisory landing on a Monday morning. You scan the CVE list, grep for "RCE" and "replication", and start mentally rebooking your week. The May 19 release from the PostgreSQL Global Development Group is one of those Mondays. Eleven security fixes, four of them scoring 8.8 on CVSS, and one route to remote code execution through a contrib module that has shipped with Postgres for decades.

What Happened

As GBHackers News reported, the PostgreSQL Global Development Group cut new minor releases across every supported branch: 18.4, 17.10, 16.14, 15.18, and 14.23. The bundle resolves 11 security flaws and more than 60 functional bugs. Every version from 14 through 18 is affected by at least some of the issues.

The severity spread is what makes this release uncomfortable. Four CVEs land at 8.8 on the CVSS scale. CVE-2026-6473 is an integer wraparound that triggers out-of-bounds writes and server crashes. CVE-2026-6475 is a symlink attack against pg_basebackup and pg_rewind that lets an attacker overwrite arbitrary files. CVE-2026-6477 hits libpq, where the lo_* large-object functions can be used by a malicious server to overwrite memory in the client process. And CVE-2026-6637 is the headliner: a stack overflow in the refint module that combines with SQL injection to enable possible RCE.

The mid-tier issues aren't decorative either. CVE-2026-6476 is SQL injection in pg_createsubscriber that executes arbitrary SQL as superuser, scored 7.2. CVE-2026-6479 is an SSL/GSS recursion flaw rated 7.5 that lets a remote caller wedge the server through socket connections. CVE-2026-6478 leaks MD5-hashed passwords via a timing side channel during authentication.

Two information leaks (CVE-2026-6474 and CVE-2026-6575) round out the list along with smaller injection issues in CREATE TYPE and REFRESH PUBLICATION. The release also bundles tzdata 2026b, which catches British Columbia's switch to permanent daylight saving time in November 2026.

Technical Anatomy

The fault patterns here tell a story about where Postgres has grown a wide attack surface. Three buckets stand out.

Replication and backup tooling. Five of the eleven CVEs sit in the operational tooling, not the SQL engine proper. pg_basebackup, pg_rewind, pg_createsubscriber, and the REFRESH PUBLICATION path all show up. These tools run with elevated privilege by definition. They touch the filesystem, they coordinate with remote nodes, they invoke superuser SQL. The symlink attack in CVE-2026-6475 is the classic shape: a privileged process follows a path it didn't validate, and an attacker who controls intermediate directories pivots that into arbitrary file overwrite. The pg_createsubscriber injection is even nastier because it runs SQL as superuser by design.

Client-server trust boundaries. CVE-2026-6477 inverts the usual threat model. Most people think of the database server as the asset to protect. This bug says a hostile server can corrupt memory in any client linked against libpq. That means application servers, batch workers, BI tools, and anything else holding a connection. If you pull a connection string from a config service and that service gets compromised, your app process becomes the target.

Contrib modules nobody reviews. The refint module is contrib code that predates most current Postgres committers. CVE-2026-6637 chains a stack buffer overflow with SQL injection to reach RCE. Teams I've worked with usually install contrib packages wholesale without auditing which modules they actually load. That habit just became expensive.

The MD5 timing attack (CVE-2026-6478) is the longest-running embarrassment in the list. MD5 password auth has been deprecated guidance for years. The PostgreSQL Global Development Group explicitly recommends switching to SCRAM-SHA-256. If your cluster still uses MD5, this CVE is your shove out the door.

Who Gets Burned

iGaming and fintech shops are the obvious blast radius. Both verticals run Postgres as the system of record under regulatory observation. A CVSS 8.8 RCE on a card-data-adjacent database means an unplanned change window, a security review, and a regulator email. Production incidents I've seen during patch panics usually come from skipped staging, not the patch itself. The patch is boring. The 3am rollback because someone forgot a replication slot is not.

Crypto and DeFi infra teams running indexers and analytics pipelines on Postgres replicas should look hard at CVE-2026-6477. A lot of these stacks pull from public or semi-public node providers. If your libpq client connects to anything you don't fully control, the trust assumption just flipped.

Ad-tech is exposed through scale. Replication topologies in that vertical tend to sprawl: dozens of read replicas, logical publications fanning out to warehouse loaders, custom subscribers. CVE-2026-6476 and CVE-2026-6638 both live in that machinery.

The hardest deadline belongs to anyone still on PostgreSQL 14. End-of-life lands November 12, 2026. After that date, no security updates. That's roughly five months from this release to plan, test, and execute a major-version upgrade. For a team running a handful of clusters with logical replication and custom extensions, five months is tight, not generous. Major-version upgrades aren't apt upgrade. They involve extension compatibility checks, query plan regressions, and usually a pg_upgrade rehearsal on real data volumes.

My take: the November 14 EOL is going to catch more teams than the CVEs will. Patching 14.23 buys you a runway, not a destination. If your roadmap doesn't already have a Postgres 16 or 17 migration scheduled, it needs one this quarter.

Playbook for Engineering Teams

Order of operations for the next two weeks:

This week. Inventory your Postgres footprint by major version. Identify which clusters load refint or expose pg_basebackup, pg_rewind, or pg_createsubscriber to non-admin contexts. Confirm whether MD5 auth is still in use anywhere in pg_hba.conf. If yes, schedule the SCRAM-SHA-256 cutover. Roll the patched minor versions (18.4, 17.10, 16.14, 15.18, 14.23) through staging on the standard cadence. The minor upgrade itself is usually a restart, not a dump-and-restore.

Next two weeks. Audit privileges on replication and subscription roles. CVE-2026-6476 only matters if untrusted SQL can reach pg_createsubscriber. Tighten the role grants so it can't. Review which contrib extensions are actually used. If refint isn't load-bearing, drop it. For observability, wire query and crash signals into your existing telemetry. OpenTelemetry instrumentation around the Postgres client lets you catch abnormal query patterns or connection churn that would indicate exploitation attempts.

This quarter. If you're on 14, start the upgrade plan now. Build a pg_upgrade dry-run against a production-sized snapshot. Catalog every extension version dependency. Run your slowest reporting queries against the new version and look for plan changes.

The uncomfortable read: most teams will patch the minor version, declare victory, and ignore the role-privilege and MD5 hygiene work. Those are the teams who will read about themselves in a breach disclosure next year.

Key Takeaways

• Patch to 18.4, 17.10, 16.14, 15.18, or 14.23 on your standard minor-release cadence. Four of the 11 CVEs score 8.8, including the refint RCE chain (CVE-2026-6637).
• The attack surface has shifted into replication and backup tooling. Five CVEs sit in pg_basebackup, pg_rewind, pg_createsubscriber, and publication paths.
• Kill MD5 password auth. CVE-2026-6478 exposes hashed passwords via timing side channel. SCRAM-SHA-256 is the documented replacement.
• CVE-2026-6477 inverts client-server trust. Any libpq-linked client connecting to an untrusted server is now in scope.
• PostgreSQL 14 reaches end-of-life November 12, 2026. Plan the major-version upgrade this quarter, not next.