Back Linuxsecurity

Fedora 44 PostgreSQL16 PostGIS Advisory on Critical Memory Disclosure Issue

Linuxsecurity •LinuxSecurity Advisories • September 27, 2026

Share: View original

CISA confirms exploitation of a Linux firewall flaw. Check if your systems need the fix. ×

PostGIS adds support for geographic objects to the PostgreSQL object-relational

database. In effect, PostGIS "spatially enables" the PostgreSQL server,

allowing it to be used as a backend spatial database for geographic information

systems (GIS), much like ESRI's SDE or Oracle's Spatial extension. PostGIS

follows the OpenGIS "Simple Features Specification for SQL" and has been

certified as compliant with the "Types and Functions" profile.

Backport fix for CVE-2026-73515.

* Wed Sep 16 2026 Sandro Mani - 3.6.4-5 - Backport fix for CVE-2026-73515 * Thu Sep 10 2026 Zbigniew Jędrzejewski-Szmek - 3.6.4-4 - Rebuilt for libxml-2.5.4 * Thu Jul 16 2026 Fedora Release Engineering - 3.6.4-3 - Rebuilt for * Fri Jun 19 2026 Sandro Mani - 3.6.4-2 - Rebuild (gdal)

[ 1 ] Bug #2520305 - CVE-2026-73515 postgresql18-postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer [fedora-all] [ 2 ] Bug #2520306 - CVE-2026-73515 postgresql17-postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer [fedora-all] [ 3 ] Bug #2520307 - CVE-2026-73515 postgresql16-postgis: PostGIS: Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer [fedora-all]

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2026-0fe48ab374' at the command line. For more information, refer to the dnf documentation available at

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Memory Disclosure Vulnerabilities in PostgreSQL PostGIS Multiple memory disclosure vulnerabilities have been identified in PostgreSQL PostGIS versions 16, 17, and 18, affecting Fedora 43 and 44. These vulnerabilities, tracked as CVE-2026-73515, allow for potential denial of service and memory disclosure via malformed FlatGeobuf buffers. CISA has confirmed active exploitation of these vulnerabilities in the wild, prompting urgent advisories for system administrators to apply patches. The vulnerabilities affect systems using PostgreSQL with PostGIS extensions, which are widely used in geographic information systems. The issues were first published on August 13, 2026, and have been backported in recent updates. Administrators are advised to upgrade their systems immediately to mitigate the risks associated with these vulnerabilities. 6 sources 73

Extracted Entities

Fedora 44 PostgreSQL16 PostGIS Advisory on Critical Memory Disclosure Issue

The full story

Extracted Entities

Companies (1)

CVEs (1)

Platforms (4)