CVE-2026-14663
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext via direct observation of the faulty ciphertext. The OpenSSL version and configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key, losing the modest protection from the Modification Detection Code (MDC). Affected functions include pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, and their bytea variants. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
Risk Assessment
The risk includes potential recovery of plaintext from encrypted data, leading to confidentiality breaches of information protected by pgcrypto.
Recommendation
Upgrade PostgreSQL to a patched version and review OpenSSL configuration to disable insecure ciphers.
Original NVD description (English source)
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.