NetApp Instaclustr Security Advisory – Multiple PostgreSQL CVEs (September 2026)
Issue Details & Impact Analysis
Through NetApp’s ongoing CVE monitoring process, NetApp has identified multiple vulnerabilities affecting PostgreSQL components used within the NetApp Instaclustr Managed Platform. These vulnerabilities affect the PostgreSQL server and client (pg_dump) components. They are tracked under the following CVE identifiers, along with NetApp’s assessed severity ratings:
| CVE ID | Description | Instaclustr Managed PostgreSQL versions affected | Upstream PostgreSQL versions affected | CVSS v3.1 score | NetApp assessed severity | Potential impact to Instaclustr Managed PostgreSQL |
|---|---|---|---|---|---|---|
| CVE-2026-6464 | psql COPY FROM STDIN early failure processes data lines as psql commands | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.1 | High (6.5) | After an early COPY FROM STDIN failure, psql can treat the remaining data lines as psql meta-commands, allowing unintended commands to execute in the client. Client-side (psql). |
| CVE-2026-6471 | Logical decoding can dlopen an arbitrary file | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 7.2 | High (5.9) | Logical decoding can be induced to dlopen an arbitrary file, potentially loading attacker-controlled code into the server process. |
| CVE-2026-14662 | Integer wraparound in tsvector/tsquery functions causes undersized allocations and out-of-bounds writes | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | An unprivileged database user can supply crafted large inputs to tsvector/tsquery functions, causing an undersized allocation and out-of-bounds write that may lead to arbitrary code execution. As these types are typically sourced from application logic rather than direct user input, exploitation through an application as a conduit is considered less likely. |
| CVE-2026-14664 | Heap buffer overflow in regexp handling | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | A user able to supply text to PostgreSQL’s regexp functions can trigger a heap buffer overflow via text that fails encoding validation, potentially resulting in arbitrary code execution as the OS user running the database. |
| CVE-2026-14668 | ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.1 | High (6.4) | Type confusion in the ctid selectivity estimator can disclose a derivative of an arbitrary memory read, leading to disclosure of server memory contents. |
| CVE-2026-14669 | Heap buffer overflow in to_char(timestamptz) | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | A user able to influence the session timezone setting can trigger a heap buffer overflow in to_char(timestamptz) via a long POSIX timezone abbreviation, potentially resulting in arbitrary code execution. |
| CVE-2026-14670 | Heap buffer overflow in PL/Perl tied objects | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Low (not scored) | A heap buffer overflow in PL/Perl tied object handling can result in arbitrary code execution as the OS user running the database. Requires the plperl extension to be in use. |
| CVE-2026-14671 | Type confusion in the refint plan cache | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Low (not scored) | Type confusion in the refint plan cache can result in arbitrary code execution. Requires the refint contrib module to be in use. |
| CVE-2026-14676 | Heap buffer overflow in pg_stat_statements via crafted array constants | 18.4 only | PG 18 only, < 18.6 | 8.8 | Urgent (7.0) | A user able to execute queries containing crafted array constants can trigger a heap buffer overflow in pg_stat_statements, potentially resulting in arbitrary code execution. 17.10 and 16.14 are not affected. |
| CVE-2026-14677 | Integer wraparound causes undersized allocations in 32-bit pltcl and plperl | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Low (not scored) | Integer wraparound in 32-bit PL/Tcl and PL/Perl leads to undersized allocations and memory corruption. Applies to 32-bit builds with those procedural languages in use. |
| CVE-2026-14679 | Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.2 | High (6.2) | A stack buffer overflow during argument matching writes 0x0 and 0x1 values into server memory, corrupting adjacent state. |
| CVE-2026-14680 | Type confusion with “internal” data type arguments | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | Any user able to call a SQL function that takes an argument of the “internal” pseudo-type can trigger type confusion, potentially resulting in arbitrary code execution as the OS user running the database. |
| CVE-2026-15741 | SQL injection in EXTRACT() expression deparse | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | An object owner can craft a hostile object definition that, when deparsed — including via pg_dump or psql \sf — executes arbitrary SQL as a superuser. |
| CVE-2026-15742 | Integer wraparound in fuzzystrmatch (levenshtein / levenshtein_less_equal) | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | A user able to call levenshtein() or levenshtein_less_equal() with extreme inputs can trigger an integer wraparound leading to effectively-arbitrary address writes and potential code execution. |
| CVE-2026-16238 | Type confusion in pg_restore_attribute_stats() via range/multirange conflation | 18.4 only | PG 18 only, < 18.6 | 8.8 | Urgent (7.0) | An object creator can trigger type confusion in pg_restore_attribute_stats() via conflation of range and multirange values, potentially resulting in arbitrary code execution. 17.10 and 16.14 are not affected. |
| CVE-2026-16239 | Type confusion in the portal/cursor lifecycle (CLOSE + DECLARE) | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | A user able to re-declare a cursor or other portal with a different type can trigger type confusion in the portal/cursor lifecycle handling, potentially resulting in arbitrary code execution. |
| CVE-2026-18408 | psql \unrestrict lets superuser of pg_dump origin server execute code in psql client | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | High (6.2) | A superuser on the origin server of a pg_dump can cause arbitrary code execution in the psql client that restores the dump, via \unrestrict. Client-side (psql). |
| CVE-2026-19385 | Heap buffer overflow in pg_dump handling long function transform lists | 18.4, 17.10, 16.14 | < 18.6, 17.11, 16.15, 15.19, 14.24 | 8.8 | Urgent (7.0) | An object creator can craft a long function transform list that, when processed by pg_dump, triggers a heap buffer overflow and arbitrary code execution as the OS user running pg_dump. Client-side (pg_dump). |
Mitigation or Remediation Approach
Our security and engineering teams have reviewed the identified PostgreSQL vulnerabilities across the NetApp Instaclustr platform. Remediation will be delivered by upgrading affected instances to PostgreSQL 18.6, 17.11, or 16.15 through our standard patching process.
These versions are not yet available on the NetApp Instaclustr Managed Platform. NetApp is currently testing them and will release them as soon as they are validated.
Customer Recommendations
We advise customers to take the following actions based on their deployment model:
Managed platform customers of Instaclustr for PostgreSQL:
- Ensure firewall rules and database access controls are configured to allow only trusted applications, users, and use-cases.
- Refer to our support documentation portal for secure configuration and access management guidance for your managed PostgreSQL cluster.
Support-only customers:
- Ensure firewall rules and database access controls are configured to only allow trusted applications, users, and use-cases.
- Upgrade to PostgreSQL version 18.6, 17.11, or 16.15 to address these vulnerabilities as soon as possible. NetApp Instaclustr Support can provide guidance for planning the upgrade operation.
NetApp Response
NetApp is remediating all affected Instaclustr for PostgreSQL clusters on the Managed Platform through an out-of-cycle patching round, targeted for late September to early October 2026. Customers will be kept informed as the rollout progresses.
The NetApp Instaclustr platform’s built-in access controls and secure-by-default configurations significantly reduce the likelihood of exploitation prior to upgrade.
Rollout of patch or mitigation
PCI enabled customers: NetApp Instaclustr will contact you directly once patched versions are available to schedule the out of cycle patching round.
All other customers: This advisory serves as notification of the availability of the upcoming out of cycle patching round. If you would like to opt in to the above-mentioned patching round, you must contact NetApp Instaclustr Support to schedule an upgrade at a time that suits you. Otherwise, you will receive the update at our next quarterly patching round in October to November.
