Medium4.3Red Hat Linux Updated

Medium [CVE-2026-14678] Information disclosure via buffer over-read in pg_trgm

This medium-severity Red Hat Linux advisory covers CVE-2026-14678 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.

CVE-2026-14678 Published Aug 13, 2026Updated by vendor Aug 13, 2026

CVE-2026-14678

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

Information disclosure via buffer over-read in pg_trgm. Red Hat rates this moderate (CVSS 4.3).

Weakness: CWE-126.

Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 4 more.

Affected products named by the advisory: Red Hat Enterprise Linux 9; Self-service automation portal 2; Red Hat package: postgresql16; Red Hat package: postgresql18.

Affected versions

< 18.5
< 17.11
< 16.15
< 15.19
< 14.24

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Restrict PostgreSQL to trusted clients. If trigram indexes are unused, drop the extension (DROP EXTENSION pg_trgm) so gtrgm_picksplit cannot run. Limit CREATE INDEX and table-owner rights on databases that use gist_trgm_ops to trusted roles.

Official advisory · high-confidence parse· fetched 1 hour ago·verify at source

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.