CVE-2026-15742

A flaw was found in PostgreSQL fuzzystrmatch. A low-privileged database user can exploit an integer wraparound vulnerability by providing extreme inputs to the levenshtein() or levenshtein_less_equal() SQL functions. This allows the user to execute arbitrary code as the operating system user running the database, potentially leading to full system compromise.

This vulnerability in the PostgreSQL fuzzystrmatch extension is rated as Important. A low-privileged database user could achieve arbitrary code execution as the operating system user running the database. This risk is present only when the fuzzystrmatch extension is explicitly installed and utilized, as it is not enabled by default in Red Hat deployments. The flaw stems from an integer wraparound when processing extreme inputs to specific SQL functions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, consider disabling the fuzzystrmatch extension within PostgreSQL if its functionality is not essential. Alternatively, the postgresql-fuzzystrmatch package can be removed. Disabling or removing the extension may affect applications that rely on the levenshtein() or levenshtein_less_equal() functions. A database service restart may be required for these changes to take effect.