RHSA-2026:27742HighCVSS 8.8

Red Hat Security Advisory: postgresql18 security update

Published
June 22, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (11)

CVE-2026-6473 →CVE-2026-6474 →CVE-2026-6475 →CVE-2026-6478 →CVE-2026-6575 →CVE-2026-6638 →CVE-2026-6472 →CVE-2026-6476 →CVE-2026-6477 →CVE-2026-6479 →CVE-2026-6637 →

📋 Description

CVE-2026-6472 — postgresql: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege CVE-2026-6473 — postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVE-2026-6474 — postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function CVE-2026-6475 — postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind CVE-2026-6476 — postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser CVE-2026-6477 — postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6478 — postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison CVE-2026-6479 — postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6575 — postgresql: PostgreSQL: Information disclosure via buffer over-read in pg_restore_attribute_stats() CVE-2026-6637 — postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module CVE-2026-6638 — postgresql: PostgreSQL: Arbitrary SQL execution via SQL injection in logical replication

🎯 Affected products108

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • postgresql18-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-0:18.4-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-debuginfo-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-debuginfo-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-debuginfo-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-contrib-debuginfo-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debuginfo-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debuginfo-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debuginfo-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debuginfo-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debugsource-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debugsource-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debugsource-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-debugsource-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-0:18.4-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-debuginfo-0:18.4-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-debuginfo-0:18.4-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • postgresql18-docs-debuginfo-0:18.4-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +78 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: To mitigate this vulnerability, validate the length of data and the size of objects on all client APIs and web interfaces. Also, block, drop, or truncate oversized string, array, or binary objects before they are passed into backend SQL queries. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers. Workaround: To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as `scram-sha-256`. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user's password: `ALTER USER username WITH PASSWORD 'new_password';` This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details. Workaround: Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability. Workaround: To mitigate this information disclosure vulnerability, restrict network access to the PostgreSQL server to only trusted clients. Configure firewall rules to limit inbound connections to the PostgreSQL port (default 5432) from authorized hosts only. For example, using `firewall-cmd` on Red Hat Enterprise Linux: `sudo firewall-cmd --permanent --add-source=<TRUSTED_IP_ADDRESS>/32 --zone=public` `sudo firewall-cmd --permanent --add-port=5432/tcp --zone=public` `sudo firewall-cmd --reload` Alternatively, configure PostgreSQL to listen only on the localhost interface by setting `listen_addresses = 'localhost'` in `postgresql.conf` and restarting the PostgreSQL service. `sudo systemctl restart postgresql` This reduces the attack surface by preventing unauthorized network access to the database. Note that restarting the PostgreSQL service will temporarily interrupt database operations. Workaround: Upgrade to PostgreSQL 18.4, 17.10, or 16.14 (matching your major version) or later, which corrects the identifier quoting used when the subscriber's apply worker sends the REFRESH PUBLICATION SQL to the publisher. Versions prior to PostgreSQL 16 are not affected. As a temporary mitigation, restrict CREATE TABLE / table-ownership privileges on subscriber databases to trusted roles only, avoid configuring logical replication subscriptions for untrusted subscriber-side users, and scope the subscription's publication-side credentials to the minimum privileges necessary.

🔗 References (7)