CVE-2026-14661

HighCVSS 8.1/10Last modified Nov 12, 2026

Description

External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-73

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
n/a	PostgreSQL	>= 18, < 18.7; >= 17, < 17.12; >= 16, < 16.16; >= 15, < 15.20; < 14.25

References

https://www.postgresql.org/support/security/CVE-2026-14661/

Timeline

Published: Nov 12, 2026
Last modified: Nov 12, 2026
NVD status: Received

Related CVEs from 2026

CVE-2026-146628.8Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to unders CVE-2026-146636.5Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertex CVE-2026-146648.8Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the databas CVE-2026-146664.2Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using ca CVE-2026-146688.1Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived fro CVE-2026-146698.8Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating sy CVE-2026-14675.3A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an CVE-2026-146708.8Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system CVE-2026-146718.8Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the dat CVE-2026-146725.3Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observ CVE-2026-146733.8Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the own CVE-2026-146768.8Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running