Red Hat Security Advisory: postgresql:18 security update

Fixed packages 49

Vulnerabilities 11

• High 8.8
  CVE-2026-6473

  PostgreSQL server undersizes allocations, via integer wraparound

  Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 8.8
  CVE-2026-6475 Public exploit

  PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

  Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 8.8
  CVE-2026-6477

  PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

  Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 8.8
  CVE-2026-6637

  PostgreSQL refint allows stack buffer overflow and SQL injection

  Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refi…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 7.5
  CVE-2026-6479

  PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

  Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 7.2
  CVE-2026-6476

  PostgreSQL pg_createsubscriber allows SQL injection via subscription name

  SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before P…

  postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 Debian Ubuntu Alpine
  May 14, 2026
• Medium 6.5
  CVE-2026-6478

  PostgreSQL discloses MD5-hashed passwords via covert timing channel

  Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• Medium 5.4
  CVE-2026-6472

  PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

  Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacke…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• Medium 4.3
  CVE-2026-6474

  PostgreSQL timeofday() can disclose portions of server memory

  Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• Medium 4.3
  CVE-2026-6575

  PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

  Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major v…

  postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 Debian Ubuntu Alpine
  May 14, 2026
• Low 3.7
  CVE-2026-6638

  PostgreSQL REFRESH PUBLICATION allows SQL injection via table name

  SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION…

  postgresql-9.3 postgresql-9.5 postgresql-10 postgresql-12 Debian Ubuntu Azure Linux Alpine
  May 14, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477447
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477448
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26204.json
• report
  https://access.redhat.com/security/cve/CVE-2026-6472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477436
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6472
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6472
• article
  https://www.postgresql.org/support/security/CVE-2026-6472/
• report
  https://access.redhat.com/security/cve/CVE-2026-6473
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6473
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6473
• article
  https://www.postgresql.org/support/security/CVE-2026-6473/
• report
  https://access.redhat.com/security/cve/CVE-2026-6474
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477441
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6474
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6474
• article
  https://www.postgresql.org/support/security/CVE-2026-6474/
• report
  https://access.redhat.com/security/cve/CVE-2026-6475
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6475
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6475
• article
  https://www.postgresql.org/support/security/CVE-2026-6475/
• report
  https://access.redhat.com/security/cve/CVE-2026-6476
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477437
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6476
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6476
• article
  https://www.postgresql.org/support/security/CVE-2026-6476/
• report
  https://access.redhat.com/security/cve/CVE-2026-6477
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6477
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6477
• article
  https://www.postgresql.org/support/security/CVE-2026-6477/
• report
  https://access.redhat.com/security/cve/CVE-2026-6478
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6478
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6478
• article
  https://www.postgresql.org/support/security/CVE-2026-6478/
• report
  https://access.redhat.com/security/cve/CVE-2026-6479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477445