Summary
[13.23-5]
- Apply patch for CVE-2026-6479 in prep section
- Resolves: CVE-2026-6479
[13.23-4]
- Backport fix for CVE-2026-6479 from PostgreSQL 14.23
(SSL/GSS init causes denial of service via uncontrolled recursion)
- Resolves: CVE-2026-6479
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | postgresql | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-contrib | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-docs | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-plperl | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-plpython3 | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-pltcl | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-private-devel | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-private-libs | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-server | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-server-devel | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-static | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-test | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-test-rpm-macros | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-upgrade | 0:13.23-5.el9_8 |
| Oracle Linux · 9 | postgresql-upgrade-devel | 0:13.23-5.el9_8 |
Vulnerabilities 1
-
High 7.5
PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP…