Product Release Advisory - VMware Tanzu for Postgres 18.4.0, 17.10.0, 16.14.0, 15.18.0, 14.23.0

Product/Component

VMware Tanzu Data Intelligence

6 more products

Notification Id

37580

Last Updated

02 June 2026

Initial Publication Date

02 June 2026

Status

OPEN

Severity

CRITICAL

CVSS Base Score

9.8

WorkAround

Affected CVE

Product Release Advisory

Advisory ID	TNZ-2026-0280
Severity	Critical
Issue Date	2026-06-02
Updated on
Synopsys	Bumped multiple dependencies updates which resulted in at least 43 CVEs remediated in this release.

Product Version Release Advisory

VMware Tanzu for Postgres 18.4.0

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-for-postgres/18-4/tnz-postgres/index.html

VMware Tanzu for Postgres 17.10.0

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-for-postgres/17-10/tnz-postgres/release-notes.html

VMware Tanzu for Postgres 16.14.0

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-for-postgres/16-14/tnz-postgres/index.html

VMware Tanzu for Postgres 15.18.0

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-for-postgres/15-18/tnz-postgres/index.html

VMware Tanzu for Postgres 14.23.0

https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-for-postgres/14-23/tnz-postgres/index.html

Security Fixes

This release has the following security fixes, listed by component and area.

Component	Vulnerabilities Resolved
VMware Tanzu for Postgres 18.4.0	GHSA-9jj7-4m8r-rfcm (critical) CVE-2026-27143 (critical) GHSA-p77j-4mvh-x3m3 (critical) CVE-2026-42501 (high) CVE-2026-39820 (high) CVE-2026-6637 (high) CVE-2026-6638 (high) CVE-2026-25679 (high) CVE-2026-42499 (high) CVE-2026-32283 (high) CVE-2026-27140 (high) CVE-2026-32280 (high) CVE-2026-27144 (high) CVE-2026-32281 (high) CVE-2026-27137 (high) CVE-2026-39836 (high) CVE-2026-33811 (high) CVE-2026-6476 (high) GHSA-mf9v-mfxr-j63j (high) CVE-2026-6479 (high) CVE-2026-6477 (high) CVE-2026-6475 (high) CVE-2026-33814 (high) CVE-2026-6473 (high) CVE-2026-33810 (high) CVE-2026-27142 (medium) CVE-2026-32289 (medium) CVE-2026-39826 (medium) GHSA-p423-j2cm-9vmq (medium) CVE-2026-32282 (medium) GHSA-m959-cc7f-wv43 (medium) CVE-2026-32288 (medium) CVE-2026-39825 (medium) CVE-2026-39819 (medium) CVE-2026-6474 (medium) CVE-2026-27138 (medium) CVE-2026-6478 (medium) CVE-2026-39817 (medium) CVE-2026-6472 (medium) CVE-2026-6575 (medium) CVE-2026-39823 (medium) CVE-2026-27139 (low) GHSA-j88v-2chj-qfwx (low)
VMware Tanzu for Postgres 17.10.0	GHSA-9jj7-4m8r-rfcm (critical) CVE-2026-27143 (critical) GHSA-p77j-4mvh-x3m3 (critical) CVE-2026-6637 (high) GHSA-mf9v-mfxr-j63j (high) CVE-2026-32281 (high) CVE-2026-27144 (high) CVE-2026-39836 (high) CVE-2026-6477 (high) CVE-2026-25679 (high) CVE-2026-33814 (high) CVE-2026-42499 (high) CVE-2026-42501 (high) CVE-2026-32283 (high) CVE-2026-33811 (high) CVE-2026-27140 (high) CVE-2026-39820 (high) CVE-2026-6638 (high) CVE-2026-6476 (high) CVE-2026-6473 (high) CVE-2026-27137 (high) CVE-2026-6475 (high) CVE-2026-32280 (high) CVE-2026-33810 (high) CVE-2026-6479 (high) CVE-2026-32282 (medium) CVE-2026-6474 (medium) CVE-2026-27142 (medium) CVE-2026-6472 (medium) CVE-2026-27138 (medium) CVE-2026-32288 (medium) CVE-2026-32289 (medium) GHSA-m959-cc7f-wv43 (medium) CVE-2026-39825 (medium) CVE-2026-39817 (medium) CVE-2026-39823 (medium) CVE-2026-39819 (medium) GHSA-p423-j2cm-9vmq (medium) CVE-2026-6478 (medium) CVE-2026-39826 (medium) CVE-2026-27139 (low) GHSA-j88v-2chj-qfwx (low)
VMware Tanzu for Postgres 16.14.0	GHSA-9jj7-4m8r-rfcm (critical) GHSA-p77j-4mvh-x3m3 (critical) CVE-2026-27143 (critical) CVE-2026-6479 (high) CVE-2026-32280 (high) GHSA-mf9v-mfxr-j63j (high) CVE-2026-6475 (high) CVE-2026-6477 (high) CVE-2026-39820 (high) CVE-2026-27140 (high) CVE-2026-33814 (high) CVE-2026-6638 (high) CVE-2026-25679 (high) CVE-2026-32283 (high) CVE-2026-32281 (high) CVE-2026-6637 (high) CVE-2026-6473 (high) CVE-2026-27137 (high) CVE-2026-39836 (high) CVE-2026-42501 (high) CVE-2026-33810 (high) CVE-2026-42499 (high) CVE-2026-27144 (high) CVE-2026-33811 (high) CVE-2026-32288 (medium) CVE-2026-6478 (medium) CVE-2026-6474 (medium) CVE-2026-39817 (medium) CVE-2026-32282 (medium) CVE-2026-6472 (medium) CVE-2026-32289 (medium) GHSA-p423-j2cm-9vmq (medium) CVE-2026-27142 (medium) CVE-2026-39826 (medium) CVE-2026-39823 (medium) CVE-2026-39819 (medium) CVE-2026-27138 (medium) GHSA-m959-cc7f-wv43 (medium) CVE-2026-39825 (medium) CVE-2026-27139 (low) GHSA-j88v-2chj-qfwx (low)
VMware Tanzu for Postgres 15.16.0	GHSA-9jj7-4m8r-rfcm (critical) CVE-2026-27143 (critical) GHSA-p77j-4mvh-x3m3 (critical) GHSA-mf9v-mfxr-j63j (high) CVE-2026-6475 (high) CVE-2026-6637 (high) CVE-2026-25679 (high) CVE-2026-27144 (high) CVE-2026-39836 (high) CVE-2026-33811 (high) CVE-2026-32283 (high) CVE-2026-32280 (high) CVE-2026-33814 (high) CVE-2026-39820 (high) CVE-2026-6473 (high) CVE-2026-6479 (high) CVE-2026-42501 (high) CVE-2026-32281 (high) CVE-2026-6477 (high) CVE-2026-33810 (high) CVE-2026-27137 (high) CVE-2026-27140 (high) CVE-2026-42499 (high) CVE-2026-6472 (medium) CVE-2026-39817 (medium) CVE-2026-32282 (medium) CVE-2026-39826 (medium) CVE-2026-27142 (medium) CVE-2026-32288 (medium) CVE-2026-39823 (medium) CVE-2026-6474 (medium) GHSA-m959-cc7f-wv43 (medium) GHSA-p423-j2cm-9vmq (medium) CVE-2026-39825 (medium) CVE-2026-32289 (medium) CVE-2026-39819 (medium) CVE-2026-6478 (medium) CVE-2026-27138 (medium) CVE-2026-27139 (low) GHSA-j88v-2chj-qfwx (low)
VMware Tanzu for Postgres 14.23.0	GHSA-p77j-4mvh-x3m3 (critical) GHSA-9jj7-4m8r-rfcm (critical) CVE-2026-27143 (critical) CVE-2026-27140 (high) CVE-2026-32280 (high) GHSA-9h8m-3fm2-qjrq (high) CVE-2026-33814 (high) CVE-2026-27137 (high) CVE-2026-39836 (high) CVE-2026-6475 (high) CVE-2026-27144 (high) CVE-2026-33811 (high) CVE-2026-42501 (high) CVE-2026-39820 (high) CVE-2026-6479 (high) CVE-2026-25679 (high) CVE-2026-6473 (high) CVE-2026-42499 (high) GHSA-mf9v-mfxr-j63j (high) CVE-2026-33810 (high) CVE-2026-6477 (high) CVE-2026-32281 (high) CVE-2026-32283 (high) CVE-2026-6637 (high) CVE-2026-39826 (medium) CVE-2026-39819 (medium) CVE-2026-6472 (medium) CVE-2026-32282 (medium) CVE-2026-27142 (medium) CVE-2026-39817 (medium) CVE-2026-27138 (medium) GHSA-p423-j2cm-9vmq (medium) CVE-2026-6478 (medium) CVE-2026-6474 (medium) CVE-2026-32289 (medium) CVE-2026-39825 (medium) CVE-2026-39823 (medium) GHSA-m959-cc7f-wv43 (medium) CVE-2026-32288 (medium) CVE-2026-27139 (low) GHSA-j88v-2chj-qfwx (low)

History

2026-06-02: Initial vulnerability report published.

Contact

E-mail: [email protected]

VMware Tanzu Security Advisories: https://tanzu.vmware.com/security