Skip to content
OpenAdvisories
Medium ALSA-2026:0594 1 CVE

Moderate: libpq security update

Published Jan 14, 2026 · Updated Oct 29, 2026

Ecosystem: AlmaLinux

Summary

The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers.

Security Fix(es):

* postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 2

ReleasePackageFixed in
AlmaLinux · 10 libpq 16.11-3.el10_1
AlmaLinux · 10 libpq-devel 16.11-3.el10_1

Vulnerabilities 1

  • Medium 5.9
    CVE-2025-12818

    PostgreSQL libpq undersizes allocations, via integer wraparound

    Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for …

    rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine

References

  • report
    https://access.redhat.com/security/cve/CVE-2025-12818
  • report
    https://bugzilla.redhat.com/2414826
  • advisory
    https://errata.almalinux.org/10/ALSA-2026-0594.html