RHSA-2026:33497HighCVSS 8.8

Red Hat Security Advisory: postgresql:15 security update

Published
June 30, 2026
Last Modified
August 5, 2026

🔗 CVE IDs covered (8)

CVE-2026-6475 →CVE-2026-6477 →CVE-2026-6478 →CVE-2026-6479 →CVE-2026-6637 →CVE-2026-6472 →CVE-2026-6473 →CVE-2026-6474 →

📋 Description

CVE-2026-6472 — postgresql: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege CVE-2026-6473 — postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVE-2026-6474 — postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function CVE-2026-6475 — postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind CVE-2026-6477 — postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory CVE-2026-6478 — postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison CVE-2026-6479 — postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6637 — postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

🎯 Affected products150

  • Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.src (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debuginfo-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debuginfo-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debuginfo-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debuginfo-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debugsource-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debugsource-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debugsource-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pg_repack-debugsource-0:1.4.8-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.src (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debuginfo-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debuginfo-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debuginfo-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debuginfo-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debugsource-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debugsource-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debugsource-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • pgaudit-debugsource-0:1.7.0-1.module+el9.2.0+17405+aeb9ec60.x86_64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • postgres-decoderbufs-0:1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60.aarch64 (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • postgres-decoderbufs-0:1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60.ppc64le (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • postgres-decoderbufs-0:1.9.7-1.Final.module+el9.2.0+17405+aeb9ec60.s390x (postgresql:15) as a component of Red Hat Enterprise Linux AppStream E4S (v.9.2)
  • +120 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Workaround: To mitigate this vulnerability, validate the length of data and the size of objects on all client APIs and web interfaces. Also, block, drop, or truncate oversized string, array, or binary objects before they are passed into backend SQL queries. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers. Workaround: To mitigate this vulnerability, ensure that all PostgreSQL user passwords are not hashed using MD5. Users should migrate to stronger hashing algorithms such as `scram-sha-256`. This can be achieved by altering user passwords, which will automatically update their hash to the currently configured default. For example, to change a user's password: `ALTER USER username WITH PASSWORD 'new_password';` This action will require users to re-authenticate. If a service relies on these credentials, it may require a restart to pick up the new authentication details. Workaround: Upgrade to PostgreSQL 18.4, 17.10, 16.14, 15.18, or 14.23 (matching your major version) or later. Restricting network/socket access to trusted clients reduces exposure but does not eliminate the vulnerability.

🔗 References (7)