CVE-2023-5869: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through miss

This month

HIGH 8.8WATCHLISTUPGRADEDOWNGRADEDOWNGRADE

CVE-2023-5869 is a high-severity flaw (CVSS 8.8) affecting postgresql, codeready linux builder eus, codeready linux builder eus for power little endian eus. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensive

Why this priority

High severity
EPSS top 9%: very likely to be exploited
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	8.8 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	4.3% (top 9%)
CISA exploited list	No
Weakness	CWE-190
Published	2023-12-10
Last modified	2026-11-02

Publisher (CNA): Red Hat, Inc. · Vendor: postgresql · redhat

Last updated 2026-11-02 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-12-10 18:15 UTCPublished CVE record published
2026-11-02 23:17 UTCUpdated Record last modified

postgresql postgresql UPGRADE

Affected: >= 11.0 and < 11.22 · >= 12.0 and < 12.17 · >= 13.0 and < 13.13 · >= 14.0 and < 14.10 · >= 15.0 and < 15.5 · 16.0

Fixed in: 11.22, 12.17, 13.13, 14.10, 15.5

Safe to downgrade to: a release before 11.0

1. Check installed version

apt-cache policy postgresql || rpm -q postgresql || postgresql --version

2. UPGRADE to 11.22 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade postgresql

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade postgresql

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 11.0 (Debian / Ubuntu)

apt-cache madison postgresql sudo apt install postgresql=<VERSION_BEFORE_11.0> sudo apt-mark hold postgresql

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list postgresql sudo dnf downgrade postgresql-<VERSION_BEFORE_11.0> sudo dnf versionlock add postgresql

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder eus DOWNGRADE

Affected: 9.2

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.2

1. Check installed version

apt-cache policy codeready-linux-builder-eus || rpm -q codeready-linux-builder-eus || codeready-linux-builder-eus --version

2. No fixed release: DOWNGRADE to a release before 9.2 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-eus sudo apt install codeready-linux-builder-eus=<VERSION_BEFORE_9.2> sudo apt-mark hold codeready-linux-builder-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-eus sudo dnf downgrade codeready-linux-builder-eus-<VERSION_BEFORE_9.2> sudo dnf versionlock add codeready-linux-builder-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder eus for power little endian eus DOWNGRADE

Affected: 9.0_ppc64le · 9.2_ppc64le

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0_ppc64le

1. Check installed version

apt-cache policy codeready-linux-builder-eus-for-power-little-endian-eus || rpm -q codeready-linux-builder-eus-for-power-little-endian-eus || codeready-linux-builder-eus-for-power-little-endian-eus --version

2. No fixed release: DOWNGRADE to a release before 9.0_ppc64le (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-eus-for-power-little-endian-eus sudo apt install codeready-linux-builder-eus-for-power-little-endian-eus=<VERSION_BEFORE_9.0_ppc64le> sudo apt-mark hold codeready-linux-builder-eus-for-power-little-endian-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-eus-for-power-little-endian-eus sudo dnf downgrade codeready-linux-builder-eus-for-power-little-endian-eus-<VERSION_BEFORE_9.0_ppc64le> sudo dnf versionlock add codeready-linux-builder-eus-for-power-little-endian-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder for arm64 eus DOWNGRADE

Affected: 8.6_aarch64 · 9.0_aarch64 · 9.2_aarch64

Fixed in: no fixed release known

Safe to downgrade to: a release before 8.6_aarch64

1. Check installed version

apt-cache policy codeready-linux-builder-for-arm64-eus || rpm -q codeready-linux-builder-for-arm64-eus || codeready-linux-builder-for-arm64-eus --version

2. No fixed release: DOWNGRADE to a release before 8.6_aarch64 (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-for-arm64-eus sudo apt install codeready-linux-builder-for-arm64-eus=<VERSION_BEFORE_8.6_aarch64> sudo apt-mark hold codeready-linux-builder-for-arm64-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-for-arm64-eus sudo dnf downgrade codeready-linux-builder-for-arm64-eus-<VERSION_BEFORE_8.6_aarch64> sudo dnf versionlock add codeready-linux-builder-for-arm64-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder for ibm z systems eus DOWNGRADE

Affected: 9.0_s390x · 9.2_s390x

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0_s390x

1. Check installed version

apt-cache policy codeready-linux-builder-for-ibm-z-systems-eus || rpm -q codeready-linux-builder-for-ibm-z-systems-eus || codeready-linux-builder-for-ibm-z-systems-eus --version

2. No fixed release: DOWNGRADE to a release before 9.0_s390x (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-for-ibm-z-systems-eus sudo apt install codeready-linux-builder-for-ibm-z-systems-eus=<VERSION_BEFORE_9.0_s390x> sudo apt-mark hold codeready-linux-builder-for-ibm-z-systems-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-for-ibm-z-systems-eus sudo dnf downgrade codeready-linux-builder-for-ibm-z-systems-eus-<VERSION_BEFORE_9.0_s390x> sudo dnf versionlock add codeready-linux-builder-for-ibm-z-systems-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

redhat codeready linux builder for power little endian eus DOWNGRADE

Affected: 9.0_ppc64le · 9.2_ppc64le

Fixed in: no fixed release known

Safe to downgrade to: a release before 9.0_ppc64le

1. Check installed version

apt-cache policy codeready-linux-builder-for-power-little-endian-eus || rpm -q codeready-linux-builder-for-power-little-endian-eus || codeready-linux-builder-for-power-little-endian-eus --version

2. No fixed release: DOWNGRADE to a release before 9.0_ppc64le (Debian / Ubuntu)

apt-cache madison codeready-linux-builder-for-power-little-endian-eus sudo apt install codeready-linux-builder-for-power-little-endian-eus=<VERSION_BEFORE_9.0_ppc64le> sudo apt-mark hold codeready-linux-builder-for-power-little-endian-eus

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list codeready-linux-builder-for-power-little-endian-eus sudo dnf downgrade codeready-linux-builder-for-power-little-endian-eus-<VERSION_BEFORE_9.0_ppc64le> sudo dnf versionlock add codeready-linux-builder-for-power-little-endian-eus

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-5869?

postgresql: upgrade to 11.22, 12.17, 13.13, 14.10, 15.5; codeready linux builder eus: downgrade or apply the listed mitigation; codeready linux builder eus for power little endian eus: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2023-5869 being exploited?

CVE-2023-5869 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-5869 affect?

CVE-2023-5869 affects postgresql, codeready linux builder eus, codeready linux builder eus for power little endian eus. Severity is high (CVSS 8.8). A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification wh

How urgent is CVE-2023-5869?

Priority 59/100. High severity; EPSS top 9%: very likely to be exploited; On your watchlist

Software pages

PostgreSQL vulnerabilities

Related CVEs

CVE-2022-2625 HIGH 8.0 UPGRADE MITIGATE A vulnerability was found in PostgreSQL
CVE-2023-39417 HIGH 7.5 UPGRADE MITIGATE IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extsche
CVE-2017-12172 MEDIUM 6.7 DOWNGRADE PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20
CVE-2018-1115 CRITICAL 9.1 UPGRADE MITIGATE postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rot
CVE-2026-6471 HIGH 7.2 UPGRADE Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to d

References

← Back to latest CVEs