5.3

CVE-2026-14672

PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count.  This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations.  Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected.  Versions before PostgreSQL 16 are unaffected.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Postgresql ≫ Postgresql Version >= 14.0 < 14.24
Postgresql ≫ Postgresql Version >= 15.0 < 15.19
Postgresql ≫ Postgresql Version >= 16.0 < 16.15
Postgresql ≫ Postgresql Version >= 17.0 < 17.11
Postgresql ≫ Postgresql Version >= 18.0 < 18.5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.39% 0.324
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-204 Observable Response Discrepancy

The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

https://www.postgresql.org/support/security/CVE-2026-14672/
Vendor Advisory