Skip to content
OpenAdvisories
High ELSA-2026-85791 1 CVE

Important: postgresql:16 security update (Oracle Linux 9)

Published Oct 20, 2026 · Updated Oct 20, 2026

Summary

pgaudit
[16.0-1]
- Update to 16.0
- Support postgresql 16
- Initial import for PG 16 module
- Resolves: RHEL-3635

pg_repack
[1.5.1-1]
- Update to v1.5.1

[1.4.8-2]
- Add new build dependencies to fix build with lz4 enabled
- Related: RHEL-47604

[1.4.8-1]
- Resolves: RHEL-3636
- Initial import for PG 16 module

pgvector
[0.8.7-1]
- Update to 0.8.7
- Fixes CVE-2026-103484 (out-of-bounds write during IVFFlat index
build, which could lead to arbitrary code execution)

[0.6.2-2]
- Enable Portable build
- Resolves: RHEL-84405

postgis
[3.5.3-6]
- Fix CVE-2026-73515

[3.5.3-5.1]
- Fix CVE-2026-73515

[3.5.3-5]
- Rebuild for adding tmt metadata

[3.5.3-4]
- Avoid perl(Pg) dependency on RHEL,
from the Fedora spec change from yselkowi@redhat.com

[3.5.3-3]
- Rebuild (gdal)

[3.5.3-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

[3.5.3-1]
- Update to 3.5.3

[3.5.2-2]
- Rebuild (SFCGAL)

[3.5.2-1]
- Update to 3.5.2

[3.5.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

postgres-decoderbufs
[2.4.0-1.Final]
- Initial import for postgresql 16 stream
- Related: RHEL-3635

postgresql
[16.15-1]
- Update to 16.15

[16.14-1]
- Update to 16.14
- Fix CVE-2026-6478

[16.13-1]
- Update to 16.13
- Fixes: CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

[16.8-3]
- Add sysusers configuration for PostgreSQL 16

[16.8-2]
- Add tmpfiles.d configuration

[16.8-1]
- Update to 16.8
- Fix CVE-2025-1094

[16.6-1]
- Update to 16.6
- Fixes: CVE-2024-10976 CVE-2024-10978 CVE-2024-10979

Fixed packages 24

ReleasePackageFixed in
Oracle Linux · 9 pg_repack 0:1.5.1-1.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 pgaudit 0:16.0-1.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 pgvector 0:0.8.7-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgis 0:3.5.3-6.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgis-client 0:3.5.3-6.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgis-docs 0:3.5.3-6.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgis-upgrade 0:3.5.3-6.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgis-utils 0:3.5.3-6.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgres-decoderbufs 0:2.4.0-1.Final.module+el9.8.0+91036+1d936f05
Oracle Linux · 9 postgresql 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-contrib 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-docs 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-plperl 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-plpython3 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-pltcl 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-private-devel 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-private-libs 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-server 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-server-devel 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-static 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-test 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-test-rpm-macros 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-upgrade 0:16.15-1.module+el9.8.0+91070+9d37edeb
Oracle Linux · 9 postgresql-upgrade-devel 0:16.15-1.module+el9.8.0+91070+9d37edeb

Vulnerabilities 1

  • High 8.8

    pgvector buffer overflow in IVFFlat index build

    IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.