Red Hat Security Advisory: libpq security update

Fixed packages 5

Vulnerabilities 4

• High 8.8
  CVE-2026-6473

  PostgreSQL server undersizes allocations, via integer wraparound

  Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 8.8
  CVE-2026-6475 Public exploit

  PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

  Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• High 8.8
  CVE-2026-6477

  PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

  Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026
• Medium 6.5
  CVE-2026-6478

  PostgreSQL discloses MD5-hashed passwords via covert timing channel

  Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…

  postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  May 14, 2026

References

• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477439
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477442
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477447
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2477448
• article
  https://access.redhat.com/security/updates/classification/#important
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27738.json
• report
  https://access.redhat.com/security/cve/CVE-2026-6473
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6473
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6473
• article
  https://www.postgresql.org/support/security/CVE-2026-6473/
• report
  https://access.redhat.com/security/cve/CVE-2026-6475
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6475
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6475
• article
  https://www.postgresql.org/support/security/CVE-2026-6475/
• report
  https://access.redhat.com/security/cve/CVE-2026-6477
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6477
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6477
• article
  https://www.postgresql.org/support/security/CVE-2026-6477/
• report
  https://access.redhat.com/security/cve/CVE-2026-6478
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6478
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6478
• article
  https://www.postgresql.org/support/security/CVE-2026-6478/