Debian updates postgresql-17 on trixie: upgrade to 17.12-0+deb13u1

CVE-2026-116303 CVE-2026-116304 CVE-2026-116306 CVE-2026-116307 CVE-2026-116308 CVE-2026-116309 CVE-2026-116310 CVE-2026-116311 Browse more CVEs PostgreSQL

Debian DSA-6625-1 updates postgresql-17 on Debian trixie to address multiple vulnerabilities, including CVE-2026-6460. Reported risks include arbitrary code execution, authentication bypass, information disclosure, denial of service, and privilege escalation. Upgrade to 17.12-0+deb13u1 and…

Debian updates postgresql-17 on trixie: upgrade to 17.12-0+deb13u1

At a glance
Debian DSA-6625-1 provides a security update for postgresql-17 on Debian trixie.
Multiple vulnerabilities may cause arbitrary code execution, authentication bypass, information disclosure, denial of service, or privilege escalation.
Upgrade to 17.12-0+deb13u1 and review extensions related to CVE-2026-6460.

In this article

Debian issued DSA-6625-1 to address multiple vulnerabilities in postgresql-17 on Debian trixie, including CVE-2026-6460. Details and update guidance are available in the Debian security advisory.

Overview and technical details

PostgreSQL is an open-source relational database management system. DSA-6625-1 addresses multiple security issues in the postgresql-17 package.

Field	Details
Advisory	Debian DSA-6625-1
Product	postgresql-17
CVEs	47 CVE IDs — view list CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116310, CVE-2026-116311, CVE-2026-116312, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116323, CVE-2026-116325, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116333, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120142, CVE-2026-120143, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6467

Affected systems

Product and branch	Affected version	Fixed version
Debian trixie, postgresql-17 source package	17.11-0+deb13u1	17.12-0+deb13u1

Mechanism and impact

The reported vulnerabilities may lead to arbitrary code execution, authentication bypass, information disclosure, denial of service, or privilege escalation. Fully addressing CVE-2026-6460 requires some extensions to be recompiled against the released version.

System checks

Display the installed postgresql-17 package version:
```
dpkg-query -W -f='${Version}\n' postgresql-17
```
Check the candidate package version and package source:
```
apt-cache policy postgresql-17
```
Compare the installed version with fixed version 17.12-0+deb13u1. The command returns a status indicating whether the installed version is lower than the fix:
```
dpkg --compare-versions "$(dpkg-query -W -f='${Version}' postgresql-17)" lt 17.12-0+deb13u1
```

According to the advisory, version 17.12-0+deb13u1 or later is fixed; earlier versions need upgrading.

Remediation and mitigation

Upgrade the postgresql-17 package on Debian trixie from the Debian trixie security repository to 17.12-0+deb13u1.
Review extensions related to CVE-2026-6460 and plan to recompile required extensions against the released version. Debian expects this to be carried out through upcoming trixie point releases.