Summary
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)
* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
* postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
* postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 24
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | pg_repack | 1.5.3-1.module_el9.8.0+234+5456f35d |
| AlmaLinux · 9 | pgaudit | 18.0-1.module_el9.8.0+234+5456f35d |
| AlmaLinux · 9 | pgvector | 0.8.1-1.module_el9.8.0+234+5456f35d |
| AlmaLinux · 9 | postgis | 3.6.1-2.module_el9.8.0+239+6fb51d38 |
| AlmaLinux · 9 | postgis-client | 3.6.1-2.module_el9.8.0+239+6fb51d38 |
| AlmaLinux · 9 | postgis-docs | 3.6.1-2.module_el9.8.0+239+6fb51d38 |
| AlmaLinux · 9 | postgis-upgrade | 3.6.1-2.module_el9.8.0+239+6fb51d38 |
| AlmaLinux · 9 | postgis-utils | 3.6.1-2.module_el9.8.0+239+6fb51d38 |
| AlmaLinux · 9 | postgres-decoderbufs | 3.3.1-1.Final.module_el9.8.0+234+5456f35d |
| AlmaLinux · 9 | postgresql | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-contrib | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-docs | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-plperl | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-plpython3 | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-pltcl | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-private-devel | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-private-libs | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-server | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-server-devel | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-static | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-test | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-test-rpm-macros | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-upgrade | 18.4-2.module_el9.8.0+280+5ad12178 |
| AlmaLinux · 9 | postgresql-upgrade-devel | 18.4-2.module_el9.8.0+280+5ad12178 |
Vulnerabilities 11
-
High 8.8
PostgreSQL server undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…
-
High 8.8CVE-2026-6475 Public exploit
PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…
-
High 8.8
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…
-
High 8.8
PostgreSQL refint allows stack buffer overflow and SQL injection
Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refi…
-
High 7.5
PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP…
-
High 7.2
PostgreSQL pg_createsubscriber allows SQL injection via subscription name
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before P…
-
Medium 6.5
PostgreSQL discloses MD5-hashed passwords via covert timing channel
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…
-
Medium 5.4
PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacke…
-
Medium 4.3
PostgreSQL timeofday() can disclose portions of server memory
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
-
Medium 4.3
PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major v…
-
Low 3.7
PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION…
References
-
report
https://access.redhat.com/security/cve/CVE-2026-6473
-
report
https://access.redhat.com/security/cve/CVE-2026-6475
-
report
https://access.redhat.com/security/cve/CVE-2026-6477
-
report
https://access.redhat.com/security/cve/CVE-2026-6478
-
report
https://bugzilla.redhat.com/2477439
-
report
https://bugzilla.redhat.com/2477442
-
report
https://bugzilla.redhat.com/2477447
-
report
https://bugzilla.redhat.com/2477448
-
advisory
https://errata.almalinux.org/9/ALSA-2026-26204.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6472.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6474.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6476.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6479.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6575.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6637.html
-
report
https://www.redhat.com/security/data/cve/CVE-2026-6638.html