RHSA-2026:28999 — Red Hat Security Advisory: postgresql:12 security update

Fixed packages 34

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	pg_repack	0:1.4.6-3.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	pg_repack-debuginfo	0:1.4.6-3.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	pg_repack-debugsource	0:1.4.6-3.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	pgaudit	0:1.4.0-7.module+el8.10.0+22214+9beb89d6
Red Hat · RHEL 8 enterprise_linux:8::appstream	pgaudit-debuginfo	0:1.4.0-7.module+el8.10.0+22214+9beb89d6
Red Hat · RHEL 8 enterprise_linux:8::appstream	pgaudit-debugsource	0:1.4.0-7.module+el8.10.0+22214+9beb89d6
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgres-decoderbufs	0:0.10.0-2.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgres-decoderbufs-debuginfo	0:0.10.0-2.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgres-decoderbufs-debugsource	0:0.10.0-2.module+el8.9.0+19330+c97ddbdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-contrib	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-contrib-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-debugsource	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-docs	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-docs-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-plperl	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-plperl-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-plpython3	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-plpython3-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-pltcl	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-pltcl-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-server	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-server-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-server-devel	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-server-devel-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-static	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-test	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-test-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-test-rpm-macros	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-upgrade	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-upgrade-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-upgrade-devel	0:12.22-7.module+el8.10.0+24362+fcf88eed
Red Hat · RHEL 8 enterprise_linux:8::appstream	postgresql-upgrade-devel-debuginfo	0:12.22-7.module+el8.10.0+24362+fcf88eed

Vulnerabilities 5

High 8.8

CVE-2026-6473

PostgreSQL server undersizes allocations, via integer wraparound

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applic…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

May 14, 2026
High 8.8

CVE-2026-6475 Public exploit

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

May 14, 2026
High 8.8

CVE-2026-6477

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like ge…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

May 14, 2026
High 8.8

CVE-2026-6637

PostgreSQL refint allows stack buffer overflow and SQL injection

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refi…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

May 14, 2026
Medium 6.5

CVE-2026-6478

PostgreSQL discloses MD5-hashed passwords via covert timing channel

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, cu…

postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine

May 14, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477447
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477448
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28999.json
report
https://access.redhat.com/security/cve/CVE-2026-6473
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6473
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6473
article
https://www.postgresql.org/support/security/CVE-2026-6473/
report
https://access.redhat.com/security/cve/CVE-2026-6475
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477439
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6475
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6475
article
https://www.postgresql.org/support/security/CVE-2026-6475/
report
https://access.redhat.com/security/cve/CVE-2026-6477
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477442
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6477
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6477
article
https://www.postgresql.org/support/security/CVE-2026-6477/
report
https://access.redhat.com/security/cve/CVE-2026-6478
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6478
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6478
article
https://www.postgresql.org/support/security/CVE-2026-6478/
report
https://access.redhat.com/security/cve/CVE-2026-6637
report
https://bugzilla.redhat.com/show_bug.cgi?id=2477443
advisory
https://www.cve.org/CVERecord?id=CVE-2026-6637
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-6637
article
https://www.postgresql.org/support/security/CVE-2026-6637/

Red Hat Security Advisory: postgresql:12 security update

Fixed packages 34

Vulnerabilities 5

PostgreSQL server undersizes allocations, via integer wraparound

PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

PostgreSQL refint allows stack buffer overflow and SQL injection

PostgreSQL discloses MD5-hashed passwords via covert timing channel

References