Description

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Remediation

References

CVE-2026-6474

Related Vulnerabilities

Magento Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') Vulnerability (CVE-2019-8126)

WordPress Plugin Ultimate Addons for Beaver Builder Cross-Site Scripting (1.24.3)

Oracle HTTP Server Other Vulnerability (CVE-2006-5346)

WordPress Plugin WordPress Download Manager Cross-Site Scripting (3.2.21)

Apache HTTP Server Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2014-0226)

Severity

Medium

Classification

CVE-2026-6474 CWE-134 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities