Back Linuxsecurity

Debian PostgreSQL DSA-6438

Linuxsecurity •LinuxSecurity Advisories • August 13, 2026

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

The upstream fix to address CVE-2026-6471 requires additional changes to the configuration if some extensions are used. This affects the postgresql-17-wal2json, postgresql-17-squeeze, postgresql-17-pg-rewrite and postgresql-17-decoderbufs extensions included in Debian. Quoting from the changelog: | Restrict logical decoding output plugins to the set specified by | a new server parameter `output_plugin_libraries` (Jacob | Champion) | Previously, a replication user could select any loadable library | | Restrict logical decoding output plugins to the set specified by | a new server parameter `output_plugin_libraries` (Jacob | Champion) | Previously, a replication user could select any loadable library | for logical decoding, allowing exploits of various sorts. To | allow locking this down without breaking setups that worked | before, introduce a whitelist of allowed output plugins. | | By default, only the output plugins shipped as part of | PostgreSQL (`pgoutput` and `test_decoding`) are included in |`ou...

Get the latest Linux and open source security news straight to your inbox.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Debian PostgreSQL Security Updates Address CVE-2026-6471 Vulnerability On August 13, 2026, CVE-2026-6471 was published, revealing a vulnerability in PostgreSQL that affects Debian systems. The flaw allows replication users to select any loadable library for logical decoding, which could lead to various exploits. The security updates for PostgreSQL versions 15 and 17 include a new server parameter, `output_plugin_libraries`, to restrict the selection of output plugins. This change is crucial for users of the postgresql-15-wal2json and postgresql-15-decoderbufs extensions, as well as postgresql-17-wal2json and others. Users must implement additional configuration changes to mitigate the risk. The updates aim to prevent unauthorized access and potential system-wide damage. Administrators are advised to audit Linux privileges to limit compromise and escalation. The situation remains critical as organizations are urged to apply the updates promptly. 2 sources 58

Extracted Entities

CVEs (1)

CVE-2026-6471