{"id":"CVE-2026-14663","year":2026,"sequence":14663,"component":"contrib module","score":6.5,"cvss_version":"3.0","vector":"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","first_published":"2026-08-13","source_url":"https://www.postgresql.org/support/security/CVE-2026-14663/","facts":{"affected":{"14":"14","15":"15","16":"16","17":"17","18":"18"},"affected_ranges":[{"from":"0","until":"14.24"},{"from":"15","until":"15.19"},{"from":"16","until":"16.15"},{"from":"17","until":"17.11"},{"from":"18","until":"18.6"}],"cna_url":"https://cveawg.mitre.org/api/cve/CVE-2026-14663","component":"contrib module","cvss_version":"3.0","description_en":"Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.","first_published":"2026-08-13","fixed":{"14":"14.24","15":"15.19","16":"16.15","17":"17.11","18":"18.6"},"id":"CVE-2026-14663","introduced":{},"published":{"14":"2026-08-13","15":"2026-08-13","16":"2026-08-13","17":"2026-08-13","18":"2026-08-13"},"score":6.5,"title":"PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext","url":"https://www.postgresql.org/support/security/CVE-2026-14663/","vector":"AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":{"locale":"zh-Hans","title":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","description":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","details":"PostgreSQL pgcrypto 在使用已被禁用的加密算法时会把数据以明文形式存储，用户可直接观察错误生成的“密文” 恢复明文。哪些算法被禁用取决于 OpenSSL 的版本与配置。如果应用接受加密数据作为输入，即使提供错误密钥， 解密也会成功，从而连修改检测码（MDC）所提供的有限保护也会失效。受影响的函数包括 pgp_sym_encrypt、 pgp_sym_decrypt、pgp_pub_encrypt、pgp_pub_decrypt，以及对应的 bytea 版本。 PostgreSQL 18.6、17.11、16.15、15.19 和 14.24 之前的版本受此问题影响。","format":"markdown","provenance":{"identity":"immutable_cve_code","sources":[{"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"component":"contrib module","cve":"2026-14663","cvenumber":202614663,"description":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","details":"PostgreSQL pgcrypto 在使用已被禁用的加密算法时会把数据以明文形式存储，用户可直接观察错误生成的“密文” 恢复明文。哪些算法被禁用取决于 OpenSSL 的版本与配置。如果应用接受加密数据作为输入，即使提供错误密钥， 解密也会成功，从而连修改检测码（MDC）所提供的有限保护也会失效。受影响的函数包括 pgp_sym_encrypt、 pgp_sym_decrypt、pgp_pub_encrypt、pgp_pub_decrypt，以及对应的 bytea 版本。 PostgreSQL 18.6、17.11、16.15、15.19 和 14.24 之前的版本受此问题影响。","detailslink":"","id":99,"legacyscore":"","newspost_id":3365,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"source":"center","source_id":99,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"},{"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"component":"contrib module","cve":"2026-14663","cvenumber":202614663,"description":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","details":"PostgreSQL pgcrypto 在使用已被禁用的加密算法时会把数据以明文形式存储，用户可直接观察错误生成的“密文” 恢复明文。哪些算法被禁用取决于 OpenSSL 的版本与配置。如果应用接受加密数据作为输入，即使提供错误密钥， 解密也会成功，从而连修改检测码（MDC）所提供的有限保护也会失效。受影响的函数包括 pgp_sym_encrypt、 pgp_sym_decrypt、pgp_pub_encrypt、pgp_pub_decrypt，以及对应的 bytea 版本。 PostgreSQL 18.6、17.11、16.15、15.19 和 14.24 之前的版本受此问题影响。","detailslink":"","id":99,"legacyscore":"","newspost_id":3365,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"},"source":"pgweb","source_id":99,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"}]},"text_hash":"c1599f93e5d3d0441a417ef11650330a35f4687e68bb6ce79603fed5fb205fcb"},"locales":["en","zh-Hans"],"fixes":[{"major":"14","fixed_version":"14.24","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"14.24","introduced":null,"published":"2026-08-13"}},{"major":"15","fixed_version":"15.19","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"15.19","introduced":null,"published":"2026-08-13"}},{"major":"16","fixed_version":"16.15","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"16.15","introduced":null,"published":"2026-08-13"}},{"major":"17","fixed_version":"17.11","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"17.11","introduced":null,"published":"2026-08-13"}},{"major":"18","fixed_version":"18.6","introduced":null,"published_date":"2026-08-13","facts":{"fixed":"18.6","introduced":null,"published":"2026-08-13"}}],"legacy":[{"source":"center","source_id":99,"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"id":99,"cve":"2026-14663","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","details":"PostgreSQL pgcrypto 在使用已被禁用的加密算法时会把数据以明文形式存储，用户可直接观察错误生成的“密文” 恢复明文。哪些算法被禁用取决于 OpenSSL 的版本与配置。如果应用接受加密数据作为输入，即使提供错误密钥， 解密也会成功，从而连修改检测码（MDC）所提供的有限保护也会失效。受影响的函数包括 pgp_sym_encrypt、 pgp_sym_decrypt、pgp_pub_encrypt、pgp_pub_decrypt，以及对应的 bytea 版本。 PostgreSQL 18.6、17.11、16.15、15.19 和 14.24 之前的版本受此问题影响。","component":"contrib module","cvenumber":202614663,"description":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":409,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":409,"patch_id":99,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":410,"source_version_id":30,"major":"17","fixed_minor":11,"raw":{"id":410,"patch_id":99,"version_id":30,"fixed_minor":11},"version_raw":{"id":30,"tree":17.0,"current":false,"docsgit":"","eoldate":"2029-11-08","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":11,"firstreldate":"2024-09-26"}},{"source_id":411,"source_version_id":29,"major":"16","fixed_minor":15,"raw":{"id":411,"patch_id":99,"version_id":29,"fixed_minor":15},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":412,"source_version_id":28,"major":"15","fixed_minor":19,"raw":{"id":412,"patch_id":99,"version_id":28,"fixed_minor":19},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":413,"source_version_id":27,"major":"14","fixed_minor":24,"raw":{"id":413,"patch_id":99,"version_id":27,"fixed_minor":24},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]},{"source":"pgweb","source_id":99,"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"id":99,"cve":"2026-14663","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","details":"PostgreSQL pgcrypto 在使用已被禁用的加密算法时会把数据以明文形式存储，用户可直接观察错误生成的“密文” 恢复明文。哪些算法被禁用取决于 OpenSSL 的版本与配置。如果应用接受加密数据作为输入，即使提供错误密钥， 解密也会成功，从而连修改检测码（MDC）所提供的有限保护也会失效。受影响的函数包括 pgp_sym_encrypt、 pgp_sym_decrypt、pgp_pub_encrypt、pgp_pub_decrypt，以及对应的 bytea 版本。 PostgreSQL 18.6、17.11、16.15、15.19 和 14.24 之前的版本受此问题影响。","component":"contrib module","cvenumber":202614663,"description":"PostgreSQL pgcrypto 对 OpenSSL 已禁用的加密算法静默使用明文","detailslink":"","legacyscore":"","newspost_id":3365},"fixes":[{"source_id":409,"source_version_id":31,"major":"18","fixed_minor":6,"raw":{"id":409,"patch_id":99,"version_id":31,"fixed_minor":6},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":410,"source_version_id":30,"major":"17","fixed_minor":11,"raw":{"id":410,"patch_id":99,"version_id":30,"fixed_minor":11},"version_raw":{"id":30,"tree":17.0,"current":false,"docsgit":"","eoldate":"2029-11-08","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":11,"firstreldate":"2024-09-26"}},{"source_id":411,"source_version_id":29,"major":"16","fixed_minor":15,"raw":{"id":411,"patch_id":99,"version_id":29,"fixed_minor":15},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":412,"source_version_id":28,"major":"15","fixed_minor":19,"raw":{"id":412,"patch_id":99,"version_id":28,"fixed_minor":19},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":413,"source_version_id":27,"major":"14","fixed_minor":24,"raw":{"id":413,"patch_id":99,"version_id":27,"fixed_minor":24},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]}]}