{"id":"CVE-2026-6474","year":2026,"sequence":6474,"component":"core server","score":4.3,"cvss_version":"3.0","vector":"AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","first_published":"2026-05-14","source_url":"https://www.postgresql.org/support/security/CVE-2026-6474/","facts":{"affected":{"14":"14","15":"15","16":"16","17":"17","18":"18"},"affected_ranges":[{"from":"0","until":"14.23"},{"from":"15","until":"15.18"},{"from":"16","until":"16.14"},{"from":"17","until":"17.10"},{"from":"18","until":"18.4"}],"cna_url":"https://cveawg.mitre.org/api/cve/CVE-2026-6474","component":"core server","cvss_version":"3.0","description_en":"Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.","first_published":"2026-05-14","fixed":{"14":"14.23","15":"15.18","16":"16.14","17":"17.10","18":"18.4"},"id":"CVE-2026-6474","introduced":{},"published":{"14":"2026-05-14","15":"2026-05-14","16":"2026-05-14","17":"2026-05-14","18":"2026-05-14"},"score":4.3,"title":"PostgreSQL timeofday() can disclose portions of server memory","url":"https://www.postgresql.org/support/security/CVE-2026-6474/","vector":"AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"reviewed_hash":"6a65a7884245936f6adaef8709d290d460e999dfce1ad78734fa7c9a324ed325","source_hash":"965b9e2323feab543f3cbeb74c418c3a5b43cbefc6594d2862ff0d24dcf8e6a2","text":{"locale":"zh-Hans","title":"PostgreSQL timeofday() 可能泄露部分服务器内存","description":"PostgreSQL timeofday() 可能泄露部分服务器内存","details":"PostgreSQL timeofday() 函数中由外部控制的格式字符串，允许攻击者通过特制的时区名称读取部分服务器内存。 PostgreSQL 18.4、17.10、16.14、15.18 和 14.23 之前的版本受此问题影响。","format":"markdown","provenance":{"identity":"immutable_cve_code","sources":[{"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"component":"core server","cve":"2026-6474","cvenumber":202606474,"description":"PostgreSQL timeofday() 可能泄露部分服务器内存","details":"PostgreSQL timeofday() 函数中由外部控制的格式字符串，允许攻击者通过特制的时区名称读取部分服务器内存。 PostgreSQL 18.4、17.10、16.14、15.18 和 14.23 之前的版本受此问题影响。","detailslink":"","id":45,"legacyscore":"","newspost_id":3294,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"source":"center","source_id":45,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"},{"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"component":"core server","cve":"2026-6474","cvenumber":202606474,"description":"PostgreSQL timeofday() 可能泄露部分服务器内存","details":"PostgreSQL timeofday() 函数中由外部控制的格式字符串，允许攻击者通过特制的时区名称读取部分服务器内存。 PostgreSQL 18.4、17.10、16.14、15.18 和 14.23 之前的版本受此问题影响。","detailslink":"","id":45,"legacyscore":"","newspost_id":3294,"public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"source":"pgweb","source_id":45,"source_table_sha256":"b57ee28b2263464208af0ccf7512b31f0c1ab7140d12dda09a0c87de341f1372"}]},"text_hash":"45ae7755e769105660acf33849a606df9dbb8c43d1bf44015d90ea46abe7caaa"},"locales":["en","zh-Hans"],"fixes":[{"major":"14","fixed_version":"14.23","introduced":null,"published_date":"2026-05-14","facts":{"fixed":"14.23","introduced":null,"published":"2026-05-14"}},{"major":"15","fixed_version":"15.18","introduced":null,"published_date":"2026-05-14","facts":{"fixed":"15.18","introduced":null,"published":"2026-05-14"}},{"major":"16","fixed_version":"16.14","introduced":null,"published_date":"2026-05-14","facts":{"fixed":"16.14","introduced":null,"published":"2026-05-14"}},{"major":"17","fixed_version":"17.10","introduced":null,"published_date":"2026-05-14","facts":{"fixed":"17.10","introduced":null,"published":"2026-05-14"}},{"major":"18","fixed_version":"18.4","introduced":null,"published_date":"2026-05-14","facts":{"fixed":"18.4","introduced":null,"published":"2026-05-14"}}],"legacy":[{"source":"center","source_id":45,"observed_at":"2026-10-03 12:08:35.169032+08","raw":{"id":45,"cve":"2026-6474","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","details":"PostgreSQL timeofday() 函数中由外部控制的格式字符串，允许攻击者通过特制的时区名称读取部分服务器内存。 PostgreSQL 18.4、17.10、16.14、15.18 和 14.23 之前的版本受此问题影响。","component":"core server","cvenumber":202606474,"description":"PostgreSQL timeofday() 可能泄露部分服务器内存","detailslink":"","legacyscore":"","newspost_id":3294},"fixes":[{"source_id":159,"source_version_id":31,"major":"18","fixed_minor":4,"raw":{"id":159,"patch_id":45,"version_id":31,"fixed_minor":4},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":160,"source_version_id":30,"major":"17","fixed_minor":10,"raw":{"id":160,"patch_id":45,"version_id":30,"fixed_minor":10},"version_raw":{"id":30,"tree":17.0,"current":false,"docsgit":"","eoldate":"2029-11-08","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":11,"firstreldate":"2024-09-26"}},{"source_id":161,"source_version_id":29,"major":"16","fixed_minor":14,"raw":{"id":161,"patch_id":45,"version_id":29,"fixed_minor":14},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":162,"source_version_id":28,"major":"15","fixed_minor":18,"raw":{"id":162,"patch_id":45,"version_id":28,"fixed_minor":18},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":163,"source_version_id":27,"major":"14","fixed_minor":23,"raw":{"id":163,"patch_id":45,"version_id":27,"fixed_minor":23},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T08:10:47.078613+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]},{"source":"pgweb","source_id":45,"observed_at":"2026-10-03 12:08:55.967155+08","raw":{"id":45,"cve":"2026-6474","public":true,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","details":"PostgreSQL timeofday() 函数中由外部控制的格式字符串，允许攻击者通过特制的时区名称读取部分服务器内存。 PostgreSQL 18.4、17.10、16.14、15.18 和 14.23 之前的版本受此问题影响。","component":"core server","cvenumber":202606474,"description":"PostgreSQL timeofday() 可能泄露部分服务器内存","detailslink":"","legacyscore":"","newspost_id":3294},"fixes":[{"source_id":159,"source_version_id":31,"major":"18","fixed_minor":4,"raw":{"id":159,"patch_id":45,"version_id":31,"fixed_minor":4},"version_raw":{"id":31,"tree":18.0,"current":true,"docsgit":"","eoldate":"2030-11-14","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":6,"firstreldate":"2025-09-25"}},{"source_id":160,"source_version_id":30,"major":"17","fixed_minor":10,"raw":{"id":160,"patch_id":45,"version_id":30,"fixed_minor":10},"version_raw":{"id":30,"tree":17.0,"current":false,"docsgit":"","eoldate":"2029-11-08","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":11,"firstreldate":"2024-09-26"}},{"source_id":161,"source_version_id":29,"major":"16","fixed_minor":14,"raw":{"id":161,"patch_id":45,"version_id":29,"fixed_minor":14},"version_raw":{"id":29,"tree":16.0,"current":false,"docsgit":"","eoldate":"2028-11-09","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":15,"firstreldate":"2023-09-14"}},{"source_id":162,"source_version_id":28,"major":"15","fixed_minor":18,"raw":{"id":162,"patch_id":45,"version_id":28,"fixed_minor":18},"version_raw":{"id":28,"tree":15.0,"current":false,"docsgit":"","eoldate":"2027-11-11","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":19,"firstreldate":"2022-10-13"}},{"source_id":163,"source_version_id":27,"major":"14","fixed_minor":23,"raw":{"id":163,"patch_id":45,"version_id":27,"fixed_minor":23},"version_raw":{"id":27,"tree":14.0,"current":false,"docsgit":"","eoldate":"2026-11-12","reldate":"2026-08-13","testing":0,"supported":true,"docsloaded":"2026-09-27T00:10:45.258078+08:00","latestminor":24,"firstreldate":"2021-09-30"}}]}]}