A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
Conclusion & alert: CVE-2023-5869 is rated Moderate Risk (63.8/100): CVSS High severity, with medium exploitation likelihood (EPSS 1.61%). Mandatory action: Review affected assets and schedule remediation.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-04 | 1.65% | 1.61% | -0.04% |
| 2 | 2026-04-21 | 1.61% | 1.65% | +0.04% |
| 3 | 2026-04-02 | — | 1.61% | — |
Full EPSS history (43 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
| 8.8 | 3.1 | HIGH |
|
2.8 | 5.9 | [email protected] |
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2023-5869: 6 source package rows (postgresql, postgresql12, postgresql14, postgresql15, postgresql16, postgresql17); 32 state rows across 13 repos (3.17-main, 3.18-community, 3.18-main, 3.19-community, 3.19-main, 3.20-community, 3.20-main, 3.21-community, 3.21-main, 3.22-community, 3.22-main, edge-community, edge-main); fixed 21, open 11. | https://security.alpinelinux.org/vuln/CVE-2023-5869 |
debian
|
not yet assigned | CVE-2023-5869 not yet assigned priority: Debian including 2 source packages (postgresql-13, postgresql-15), 2 status rows across 2 suites (bookworm, bullseye): resolved 2. | https://security-tracker.debian.org/tracker/CVE-2023-5869 |
gentoo
|
normal | CVE-2023-5869: 1 GLSA(s) (202408-06), 1 atom(s) (dev-db/postgresql); latest impact normal. | https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-5869 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2023-5869 |
suse
|
critical | CVE-2023-5869 severity critical: SUSE including 610 source package names (14.10-24.14:libpq5-16.1-150200.5.7.1, 14.10-24.14:postgresql-16-150400.4.9.2, …), 1437 product×package rows across 47 product lines (Container suse/postgres, Image SLES15-SP4-Manager-Server-4-3, … (47 product lines)): Fixed 1206, Known Affected 231. | https://www.suse.com/security/cve/CVE-2023-5869/ |
ubuntu
|
medium | CVE-2023-5869 medium priority: Ubuntu including 8 source packages (postgresql-10, postgresql-12, …), 96 status rows across 12 suites (bionic, focal, jammy, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 77, released 10, ignored 5, not-affected 2, deferred 1, needs-triage 1. | https://ubuntu.com/security/CVE-2023-5869 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| postgresql | postgresql | >= 11.0, < 11.22 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| postgresql | postgresql | >= 12.0, < 12.17 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| postgresql | postgresql | >= 13.0, < 13.13 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| postgresql | postgresql | >= 14.0, < 14.10 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| postgresql | postgresql | >= 15.0, < 15.5 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |
| postgresql | postgresql | 16.0 | cpe:2.3:a:postgresql:postgresql:16.0:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_eus | 9.2 | cpe:2.3:a:redhat:codeready_linux_builder_eus:9.2:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_eus_for_power_little_endian_eus | 9.0_ppc64le | cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.0_ppc64le:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_eus_for_power_little_endian_eus | 9.2_ppc64le | cpe:2.3:a:redhat:codeready_linux_builder_eus_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_arm64_eus | 8.6_aarch64 | cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:8.6_aarch64:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_arm64_eus | 9.0_aarch64 | cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.0_aarch64:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_arm64_eus | 9.2_aarch64 | cpe:2.3:a:redhat:codeready_linux_builder_for_arm64_eus:9.2_aarch64:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 9.0_s390x | cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.0_s390x:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_ibm_z_systems_eus | 9.2_s390x | cpe:2.3:a:redhat:codeready_linux_builder_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 9.0_ppc64le | cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.0_ppc64le:*:*:*:*:*:*:* |
| redhat | codeready_linux_builder_for_power_little_endian_eus | 9.2_ppc64le | cpe:2.3:a:redhat:codeready_linux_builder_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* |
| redhat | software_collections | 1.0 | cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 8.0 | cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux | 9.0 | cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop | 7.0 | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 8.8 | cpe:2.3:o:redhat:enterprise_linux_eus:8.8:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 9.0 | cpe:2.3:o:redhat:enterprise_linux_eus:9.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_eus | 9.2 | cpe:2.3:o:redhat:enterprise_linux_eus:9.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_arm_64 | 8.0 | cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_arm_64 | 8.8_aarch64 | cpe:2.3:o:redhat:enterprise_linux_for_arm_64:8.8_aarch64:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems | 7.0_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems | 8.0_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.6_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 8.8_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.8_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.0_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.0_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_ibm_z_systems_eus | 9.2_s390x | cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:9.2_s390x:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_big_endian | 7.0_ppc64 | cpe:2.3:o:redhat:enterprise_linux_for_power_big_endian:7.0_ppc64:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian | 7.0_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian | 8.0_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.6_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.6_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 8.8_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.8_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.0_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.0_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_power_little_endian_eus | 9.2_ppc64le | cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:9.2_ppc64le:*:*:*:*:*:*:* |
| redhat | enterprise_linux_for_scientific_computing | 7.0 | cpe:2.3:o:redhat:enterprise_linux_for_scientific_computing:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server | 7.0 | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus | 9.2 | cpe:2.3:o:redhat:enterprise_linux_server_aus:9.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 8.2 | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 8.4 | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_tus | 8.6 | cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation | 7.0 | cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* |