Debian PostgreSQL CVE-2026-6460 and Sympa Need Urgent Patches

I saw Debian's security advisories for PostgreSQL 17 and Sympa on 13 Nov. 2026, so I put this together as a follow-up to the server update roundup from 11 Nov. This batch calls for checks on both databases and mail archives. The PostgreSQL version numbers in the advisory and the Tracker differ, so compare them carefully before concluding that the updates are complete.

The table references the PostgreSQL Tracker and the Sympa Tracker. Packages from other repositories need their advisories checked separately.

PostgreSQL has bugs in data types and restore tools

DSA-6625-1 lists several vulnerabilities, with impacts including code execution, incorrect authentication, information disclosure, denial of service, and privilege escalation. I picked two examples to help prioritize the work.

CVE-2026-6460 is a type confusion issue after a data type change, such as ALTER ... SET DATA TYPE. Old data may remain, but the system reads it using the new structure. Someone with permission to create objects in the database may exploit this to execute code. The code runs under the operating system account that runs the database. Permission to create objects is an important prerequisite for the attack, according to the PostgreSQL description.

The other is CVE-2026-116314 in pg_restore. This involves a non-plain archive prepared by an attacker. When a user opens the file with a vulnerable version of pg_restore, code may run under the operating system account invoking the tool. Backup and restore work therefore requires checking client packages too. Every machine receiving files for restoration needs to be updated.

Read severity alongside attack prerequisites

The PostgreSQL CVE pages rate both examples 8.8. CVE-2026-6460 uses the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, while CVE-2026-116314 uses AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The first requires low privileges. The second requires no privileges on the system, but does require a user to open a file with a vulnerable tool. Both have a high impact on confidentiality, integrity, and availability.

The CVSS version labels differ across official sources. The individual CVE pages say CVSS 3.0, while the release announcement says CVSS v3.1. The official CVE records for CVE-2026-6460 and CVE-2026-116314 specify CVSS 3.1, with vectors matching those above. Every source gives these two identifiers a score of 8.8. This score does not represent every vulnerability in the batch.

Neither DSA reports attacks in the wild. I checked the KEV JSON from CISA's official repository, and CVE-2026-6460 and CVE-2026-116314 were not in the 10 Nov. 2026 KEV edition (catalogVersion: 2026.11.10), so there are no KEV addition dates or remediation deadlines for these two identifiers. Absence from the list does not mean there have been no attacks.

Sympa risks unauthorized access to mail archives

DSA-6624-1 describes path traversal and authorization bypass issues. An attacker may be able to read deleted archives or raw message files, so access permissions for these files should also be tested after updating. The impact stated in the advisory is access to messages; it does not mention code execution.

The advisory lists the CVE as not yet available and provides no CVSS score, so I have not included a number without a source. The fixed version in both the DSA and the Tracker is 6.2.76~dfsg-1+deb13u1 on trixie.

The Sympa package page also shows this issue as vulnerable in bookworm, but this DSA provides a fixed version only for trixie. Anyone running bookworm needs to follow advisories for that release, and should not install trixie packages across releases.

Update the packages and restart the right services

Check the system and packages with dpkg-query, counting only those with an installed status.

cat /etc/os-release
dpkg-query -W -f='${binary:Package}\t${Version}\t${db:Status-Status}\n' \
  postgresql-17 postgresql-client-17 sympa
pg_lsclusters

1. Compare versions Check the release and package sources against the Tracker
2. Prepare backups Check the recovery path and schedule downtime
3. Review the updates Simulate before installing, including the clients and extensions in use
4. Restart services Check database clusters and web archive processes, then test actual workloads

Apply this only to Debian packages already installed. After update, check the Candidate and repository using apt-cache policy. If the Candidate is still below the fixed version, check the update sources first.

sudo apt-get update
apt-cache policy postgresql-17 postgresql-client-17 sympa
sudo apt-get -s install --only-upgrade postgresql-17 postgresql-client-17
sudo apt-get -s install --only-upgrade sympa
# อ่านผลจำลองและเตรียมช่วงหยุดบริการก่อนติดตั้ง
sudo apt-get install --only-upgrade postgresql-17 postgresql-client-17

--only-upgrade does not install new packages that are not already present. Check extension packages as well. Installation may restart services during the update, so allow for this in the maintenance window.

For PostgreSQL, use the cluster name returned by pg_lsclusters. The example name main is a placeholder; replace it with the cluster you need to maintain. A restart disconnects clients, so prepare the application for it. Do not substitute a reload, because pg_ctlcluster states that a reload only rereads the configuration.

# ตัวอย่างสำหรับคลัสเตอร์ PostgreSQL 17 ชื่อ main เท่านั้น
sudo pg_ctlcluster 17 main restart
sudo pg_ctlcluster 17 main status
pg_lsclusters

The DSA warns that CVE-2026-6460 also requires some extensions to be recompiled. Debian will roll this out through trixie point releases. The 17.12 release notes state that C extensions must be recompiled for full protection, and some also require source changes. If you plan to disable type checking to address compatibility problems, assess the risk first.

For Sympa, restart the WWSympa web processes too; do not check only the mail sender. The upgrade manual recommends stopping the service, backing up the configuration and database, then installing before restarting. If FastCGI runs separately, stop that component as well, while keeping the database service running during the Sympa upgrade.

For systems using the unit names and socket activation described in the WWSympa manual, check the units before using the commands below. Systems using other FastCGI setups need the commands for their process manager.

systemctl list-unit-files 'sympa*' 'wwsympa*'
# เฉพาะระบบที่มี unit เหล่านี้และใช้ socket activation
# หยุดก่อนติดตั้งแพ็กเกจ Sympa ในช่วงบำรุงรักษา
sudo systemctl stop wwsympa.socket
sudo systemctl stop wwsympa.service
sudo systemctl stop sympa.service
sudo apt-get install --only-upgrade sympa
sudo systemctl start sympa.service
sudo systemctl start wwsympa.socket

When a request reaches the socket, the system starts WWSympa again. Test sending and receiving mail, along with archive read permissions, using test accounts with different permissions.

For PostgreSQL, anyone using incremental backups should take a new full backup after updating and use it as the base for subsequent incremental backups. Also check whether any indexes require REINDEX according to the release notes, and apply it only where the conditions match.

Check for anomalies and prioritize the work

Neither DSA provides IOCs for determining whether an attack has occurred. Preserve the web archive's access logs, check requests to read files that should not be exposed, and compare them with the requesting account's permissions. On the database side, check for unauthorized object creation or changes, along with the history of archives received for restoration. These are general investigation steps; they cannot confirm an attack using this batch of vulnerabilities on their own.

I recommend that administrators prioritize updates for databases where multiple groups of users can create objects, and Sympa web archives accessible to users. Schedule a maintenance window soon. While preparing the patches, restrict access to components that do not need to be accessible. This reduces exposed access points, but the DSAs do not endorse it as a substitute for patching.

Sources: Debian DSA-6625-1, Debian PostgreSQL Tracker, Debian DSA-6624-1, Debian Sympa Tracker, PostgreSQL CVE-2026-6460, PostgreSQL CVE-2026-116314, PostgreSQL release notes, Sympa manual, CISA KEV JSON, and the CVE records and official command manuals linked in the article. Information is current through 13 Nov. 2026 for this draft awaiting review. I'll come back and add updates later.