Skip to content
OpenAdvisories
High RHSA-2026:21182 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published May 29, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 15

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 postgresql17 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-contrib 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-docs 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-plperl 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-plpython3 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-pltcl 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-private-devel 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-private-libs 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-server 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-server-devel 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-static 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-test 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-test-rpm-macros 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-upgrade 0:17.10-0.1.hum1
Red Hat · Hardened Images 1 hummingbird:1 postgresql17-upgrade-devel 0:17.10-0.1.hum1

Vulnerabilities 8

  • High 8.8
    CVE-2026-6475 Public exploit

    PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

    Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-6477

    PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

    Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • High 8.8
    CVE-2026-6637

    PostgreSQL refint allows stack buffer overflow and SQL injection

    Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refi…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • High 7.5
    CVE-2026-6479

    PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

    Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • Medium 6.5
    CVE-2026-6478

    PostgreSQL discloses MD5-hashed passwords via covert timing channel

    Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • Medium 5.4
    CVE-2026-6472

    PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

    Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacke…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2026-6575

    PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

    Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major v…

    postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 Debian Ubuntu Alpine
  • Low 3.7
    CVE-2026-6638

    PostgreSQL REFRESH PUBLICATION allows SQL injection via table name

    SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION…

    postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 Debian Ubuntu Azure Linux Alpine

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6478
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2026-6477
  • report
    https://access.redhat.com/security/cve/CVE-2026-6475
  • report
    https://access.redhat.com/security/cve/CVE-2026-6575
  • report
    https://access.redhat.com/security/cve/CVE-2026-6472
  • report
    https://access.redhat.com/security/cve/CVE-2026-6479
  • report
    https://access.redhat.com/security/cve/CVE-2026-6637
  • report
    https://access.redhat.com/security/cve/CVE-2026-6638
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_21182.json
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477436
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6472
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6472
  • article
    https://www.postgresql.org/support/security/CVE-2026-6472/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477439
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6475
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6475
  • article
    https://www.postgresql.org/support/security/CVE-2026-6475/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477442
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6477
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6477
  • article
    https://www.postgresql.org/support/security/CVE-2026-6477/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477447
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6478
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6478
  • article
    https://www.postgresql.org/support/security/CVE-2026-6478/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477445
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6479
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6479
  • article
    https://www.postgresql.org/support/security/CVE-2026-6479/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477440
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6575
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6575
  • article
    https://www.postgresql.org/support/security/CVE-2026-6575/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2477443
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-6637
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-6637
  • article
    https://www.postgresql.org/support/security/CVE-2026-6637/