GHSA-5pr9-9395-q5gq · 严重度： high — Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via...
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
结论预警: CVE-2026-2007 综合评估为中等风险（46.2/100）：CVSS 技术影响为高级，利用概率偏低（EPSS 0.48%） 强制指令: 梳理受影响资产并纳入修补计划。
风险随态势动态变化；本站持续评估并同步更新本页展示内容。
EPSS 日更估计相对被利用可能性；百分位表示该 CVE 在已评分漏洞中的相对排名（越高表示相对更严重）。
| # | 日期 | 旧 EPSS 分数 | 新 EPSS 分数 | 变化（新 − 旧） |
|---|---|---|---|---|
| 1 | 2026-06-30 | 0.34% | 0.48% | +0.15% |
| 2 | 2026-06-15 | 0.02% | 0.34% | +0.32% |
| 3 | 2026-03-21 | — | 0.02% | — |
完整 EPSS 历史 （共 5 条）
该 CVE 的 CVSS 指标。
| 底座分 | 版本 | 严重度 | 向量 | 可利用性 | 影响 | 分数来源 |
|---|---|---|---|---|---|---|
| 8.2 | 3.1 | HIGH |
|
3.9 | 4.2 | f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 |
| 8.2 | 3.1 | HIGH |
|
3.9 | 4.2 | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
GHSA-5pr9-9395-q5gq · 严重度： high — Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via...
| vendor | priority | summary | link |
|---|---|---|---|
alpine
|
— | CVE-2026-2007: 4 source package rows (postgresql15, postgresql16, postgresql17, postgresql18); 21 state rows across 7 repos (3.20-main, 3.21-main, 3.22-main, 3.23-community, 3.23-main, edge-community, edge-main); fixed 21, open 0. | https://security.alpinelinux.org/vuln/CVE-2026-2007 |
debian
|
unimportant | CVE-2026-2007 unimportant priority: Debian including 4 source packages (postgresql-13, postgresql-15, postgresql-17, postgresql-18), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2026-2007 |
redhat
|
high | — | https://access.redhat.com/security/cve/CVE-2026-2007 |
suse
|
high | CVE-2026-2007 severity important: SUSE including 132 source package names (docker-28.5.1_ce-slfo.1.1_8.1, docker-buildx-0.29.0-slfo.1.1_8.1, …), 850 product×package rows across 49 product lines (Container suse/manager/5.0/x86_64/server, Container suse/manager/5.0/x86_64/server-migration-14-16, … (49 product lines)): Known Not Affected 657, Fixed 182, First Fixed 11. | https://www.suse.com/security/cve/CVE-2026-2007/ |
ubuntu
|
medium | CVE-2026-2007 medium priority: Ubuntu including 8 source packages (postgresql-10, postgresql-12, …), 36 status rows across 8 suites (bionic, focal, jammy, noble, questing, trusty, upstream, xenial): DNE 21, not-affected 7, ignored 4, needs-triage 2, deferred 1, released 1. | https://ubuntu.com/security/CVE-2026-2007 |
| 厂商 | 产品 | 版本 | 原始 CPE |
|---|---|---|---|
| postgresql | postgresql | >= 18.0, < 18.2 | cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* |