Red Hat Security Advisory: postgresql security update

Fixed packages 21

Vulnerabilities 2

• Medium 5.9
  CVE-2025-12818

  PostgreSQL libpq undersizes allocations, via integer wraparound

  Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for …

  rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine
  Nov 13, 2025
• Low 3.1
  CVE-2025-12817

  PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

  Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privile…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  Nov 13, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414825
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2414826
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_0263.json
• report
  https://access.redhat.com/security/cve/CVE-2025-12817
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-12817
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-12817
• article
  https://www.postgresql.org/support/security/CVE-2025-12817/
• report
  https://access.redhat.com/security/cve/CVE-2025-12818
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-12818
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-12818
• article
  https://www.postgresql.org/support/security/CVE-2025-12818/