Skip to content
OpenAdvisories
High RHSA-2026:8756 8 CVEs

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published Apr 21, 2026 · Updated Oct 6, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Hardened Images 1 hummingbird:1 postgresql18 0:18.3-1.2.hum1

Vulnerabilities 8

  • High 8.8
    CVE-2026-2004

    PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

    Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-2005 Public exploit

    PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2026-2006

    PostgreSQL missing validation of multibyte character length executes arbitrary code

    Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions…

    rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.2
    CVE-2026-2007

    PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

    Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to pri…

    postgresql-9.3 postgresql15 postgresql16 postgresql17 Debian Ubuntu Alpine
  • Medium 5.9
    CVE-2025-12818

    PostgreSQL libpq undersizes allocations, via integer wraparound

    Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for …

    rust postgresql-9.3 postgresql15 postgresql-9.5 Debian Ubuntu Azure Linux Alpine
  • Medium 4.3
    CVE-2026-2003

    PostgreSQL oidvector discloses a few bytes of memory

    Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely.…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine Wolfi
  • Low 3.1
    CVE-2025-12817

    PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

    Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privile…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Azure Linux Alpine
  • Unscored —
    CVE-2010-1975

    PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 befor…

References

  • article
    https://images.redhat.com/
  • report
    https://access.redhat.com/security/cve/CVE-2025-12818
  • article
    https://access.redhat.com/security/updates/classification/
  • report
    https://access.redhat.com/security/cve/CVE-2025-12817
  • report
    https://access.redhat.com/security/cve/CVE-2010-1975
  • report
    https://access.redhat.com/security/cve/CVE-2026-2007
  • report
    https://access.redhat.com/security/cve/CVE-2026-2006
  • report
    https://access.redhat.com/security/cve/CVE-2026-2005
  • report
    https://access.redhat.com/security/cve/CVE-2026-2004
  • report
    https://access.redhat.com/security/cve/CVE-2026-2003
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8756.json
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2010-1975
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2010-1975
  • article
    http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
  • article
    http://marc.info/?l=bugtraq&m=134124585221119&w=2
  • article
    http://secunia.com/advisories/39939
  • article
    http://www.debian.org/security/2010/dsa-2051
  • article
    http://www.mandriva.com/security/advisories?name=MDVSA-2010:103
  • article
    http://www.postgresql.org/docs/current/static/release-7-4-29.html
  • article
    http://www.postgresql.org/docs/current/static/release-8-0-25.html
  • article
    http://www.postgresql.org/docs/current/static/release-8-1-21.html
  • article
    http://www.postgresql.org/docs/current/static/release-8-2-17.html
  • article
    http://www.postgresql.org/docs/current/static/release-8-3-11.html
  • article
    http://www.postgresql.org/docs/current/static/release-8-4-4.html
  • article
    http://www.securityfocus.com/bid/40304
  • article
    http://www.vupen.com/english/advisories/2010/1207
  • article
    http://www.vupen.com/english/advisories/2010/1221
  • article
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11004
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414825
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-12817
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-12817
  • article
    https://www.postgresql.org/support/security/CVE-2025-12817/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2414826
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-12818
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-12818
  • article
    https://www.postgresql.org/support/security/CVE-2025-12818/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2439322
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2026-2003
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2026-2003