Executive brief
PostgreSQL is a widely used database system for storing and managing corporate data. A security flaw in how the system verifies older password formats (MD5) could allow an attacker to guess user credentials by measuring the time it takes for the server to respond to login attempts. If successful, an attacker could gain unauthorized access to the database, potentially leading to data theft or unauthorized modifications.
Technical details
A covert timing channel vulnerability (CWE-385) exists in the authentication component of the PostgreSQL core server. The flaw resides in the non-constant-time comparison of MD5-hashed passwords during the authentication handshake. By measuring infinitesimal differences in response times, a network-based attacker can iteratively deduce the correct hash values. This issue primarily affects legacy environments or databases upgraded from PostgreSQL 13 or earlier that still utilize MD5 hashing; modern installations using the default SCRAM-SHA-256 are not affected. Patches have been released in versions 18.4, 17.10, 16.14, 15.18, and 14.23.
Affected products
- PostgreSQL PostgreSQL < 18.4, < 17.10, < 16.14, < 15.18, < 14.23
Timeline
- 2026-05-14: disclosed
- 2026-05-14: patched
- 2026-05-14: advisory