RHSA-2026:4516 — Red Hat Security Advisory: postgresql:13 security update

Fixed packages 102

Release	Package	Fixed in
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pg_repack	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pg_repack-debuginfo	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pg_repack-debugsource	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pgaudit	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pgaudit-debuginfo	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	pgaudit-debugsource	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgres-decoderbufs	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgres-decoderbufs-debuginfo	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgres-decoderbufs-debugsource	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-contrib	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-contrib-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-debugsource	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-docs	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-docs-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-plperl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-plperl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-plpython3	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-plpython3-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-pltcl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-pltcl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-server	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-server-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-server-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-server-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-static	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-test	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-test-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-test-rpm-macros	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-upgrade	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-upgrade-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-upgrade-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 AUS rhel_aus:8.6::appstream	postgresql-upgrade-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pg_repack	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pg_repack-debuginfo	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pg_repack-debugsource	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pgaudit	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pgaudit-debuginfo	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	pgaudit-debugsource	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgres-decoderbufs	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgres-decoderbufs-debuginfo	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgres-decoderbufs-debugsource	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-contrib	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-contrib-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-debugsource	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-docs	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-docs-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-plperl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-plperl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-plpython3	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-plpython3-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-pltcl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-pltcl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-server	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-server-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-server-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-server-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-static	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-test	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-test-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-test-rpm-macros	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-upgrade	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-upgrade-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-upgrade-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 E4S rhel_e4s:8.6::appstream	postgresql-upgrade-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pg_repack	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pg_repack-debuginfo	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pg_repack-debugsource	0:1.4.6-3.module+el8.5.0+11357+bcc62552
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pgaudit	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pgaudit-debuginfo	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	pgaudit-debugsource	0:1.5.0-1.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgres-decoderbufs	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgres-decoderbufs-debuginfo	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgres-decoderbufs-debugsource	0:0.10.0-2.module+el8.4.0+8873+b821c30a
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-contrib	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-contrib-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-debugsource	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-docs	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-docs-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-plperl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-plperl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-plpython3	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-plpython3-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-pltcl	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-pltcl-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-server	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-server-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-server-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-server-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-static	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-test	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-test-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-test-rpm-macros	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-upgrade	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-upgrade-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-upgrade-devel	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2
Red Hat · RHEL 8.6 TUS rhel_tus:8.6::appstream	postgresql-upgrade-devel-debuginfo	0:13.23-1.module+el8.6.0+24072+5a7aa9c7.2

Vulnerabilities 3

High 8.8

CVE-2026-2004

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and …

postgresql15 postgresql-15 postgresql16 postgresql-9.3 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 12, 2026
High 8.8

CVE-2026-2005 Public exploit

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

postgresql15 postgresql-15 postgresql16 postgresql-9.3 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 12, 2026
High 8.8

CVE-2026-2006

PostgreSQL missing validation of multibyte character length executes arbitrary code

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions…

rust postgresql15 postgresql-15 postgresql16 Debian Ubuntu Azure Linux Alpine Wolfi

Feb 12, 2026

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439324
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439325
report
https://bugzilla.redhat.com/show_bug.cgi?id=2439326
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_4516.json
report
https://access.redhat.com/security/cve/CVE-2026-2004
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2004
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2004
article
https://www.postgresql.org/support/security/CVE-2026-2004/
report
https://access.redhat.com/security/cve/CVE-2026-2005
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2005
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2005
article
https://www.postgresql.org/support/security/CVE-2026-2005/
report
https://access.redhat.com/security/cve/CVE-2026-2006
advisory
https://www.cve.org/CVERecord?id=CVE-2026-2006
advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-2006
article
https://www.postgresql.org/support/security/CVE-2026-2006/

Red Hat Security Advisory: postgresql:13 security update

Fixed packages 102

Vulnerabilities 3

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

PostgreSQL missing validation of multibyte character length executes arbitrary code

References