RHSA-2026:99821HighCVSS 8.8

Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

Published
November 12, 2026
Last Modified
November 14, 2026

🔗 CVE IDs covered (52)

CVE-2026-120151 →CVE-2026-116311 →CVE-2026-16240 →CVE-2026-116304 →CVE-2026-116308 →CVE-2026-116320 →CVE-2026-120145 →CVE-2026-120146 →CVE-2026-120148 →CVE-2026-116322 →CVE-2026-116325 →CVE-2026-116333 →CVE-2026-120143 →CVE-2026-120150 →CVE-2026-6460 →CVE-2026-6467 →CVE-2026-14661 →CVE-2026-116307 →CVE-2026-116319 →CVE-2026-116326 →CVE-2026-116332 →CVE-2026-116306 →CVE-2026-116314 →CVE-2026-116316 →CVE-2026-116317 →CVE-2026-120139 →CVE-2026-120142 →CVE-2026-120144 →CVE-2026-120153 →CVE-2026-116303 →CVE-2026-116318 →CVE-2026-116321 →CVE-2026-116327 →CVE-2026-116328 →CVE-2026-116331 →CVE-2026-116336 →CVE-2026-120141 →CVE-2026-16237 →CVE-2026-116309 →CVE-2026-116313 →CVE-2026-116329 →CVE-2026-116335 →CVE-2026-120149 →CVE-2026-120152 →CVE-2026-116312 →CVE-2026-116323 →CVE-2026-120154 →CVE-2026-18447 →CVE-2026-116310 →CVE-2026-116315 →CVE-2026-116330 →CVE-2026-120147 →

📋 Description

CVE-2026-6460 — postgresql: postgresql: Arbitrary code execution via type confusion in data definition commands CVE-2026-6467 — postgresql: postgresql: Privilege escalation via uncontrolled search path in extension management CVE-2026-14661 — postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter CVE-2026-16237 — postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views CVE-2026-16240 — postgresql: postgresql: Information disclosure in pg_basebackup via crafted backup manifest CVE-2026-18447 — postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions CVE-2026-116303 — postgresql: PostgreSQL: Unauthorized execution of restricted cast functions via type conversion operations CVE-2026-116304 — postgresql: postgresql: Arbitrary code execution via use-after-free in parallel worker coordination CVE-2026-116306 — postgresql: postgresql: Arbitrary code execution via composite-value field assignment type confusion CVE-2026-116307 — postgresql: postgresql: Arbitrary code execution via use-after-free in plperl CVE-2026-116308 — postgresql: postgresql: Information disclosure via zero-length token in dict_int CVE-2026-116309 — postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl CVE-2026-116310 — postgresql: postgresql: Information disclosure via use-after-free in COPY FROM error reporting CVE-2026-116311 — postgresql: postgresql: row-level security bypass via DROP OWNED CVE-2026-116312 — postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE CVE-2026-116313 — postgresql: postgresql: Privilege escalation via untrusted search path in vacuumdb CVE-2026-116314 — postgresql: postgresql: Arbitrary code execution via crafted archive in pg_restore CVE-2026-116315 — postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in tsvector_delete() CVE-2026-116316 — postgresql: PostgreSQL: Privilege escalation via unqualified type resolution in temporary schema CVE-2026-116317 — postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in ts_rank_cd() CVE-2026-116318 — postgresql: postgresql: Arbitrary SQL execution via improper constraint quoting in pg_dump CVE-2026-116319 — postgresql: postgresql: Arbitrary code execution via use-after-free in plperl CVE-2026-116320 — postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Perl CVE-2026-116321 — postgresql: postgresql: server memory disclosure via improper null termination in array element assignment CVE-2026-116322 — postgresql: postgresql: Denial of Service via improper locking during startup processing CVE-2026-116323 — postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Tcl CVE-2026-116325 — postgresql: postgresql: Arbitrary SQL execution in reindexdb via crafted index name CVE-2026-116326 — postgresql: postgresql: Arbitrary code execution via uncaught exceptions in PL/Perl CVE-2026-116327 — postgresql: postgresql: Information disclosure via security barrier view bypass CVE-2026-116328 — postgresql: postgresql: Arbitrary code execution via integer wraparound in memory contexts CVE-2026-116329 — postgresql: postgresql: arbitrary code execution via nested SET DATA TYPE during statistics import CVE-2026-116330 — postgresql: postgresql: Arbitrary code execution via predictable restriction key in pg_dump restore script CVE-2026-116331 — postgresql: postgresql: Arbitrary code execution via aggregate optimization type confusion CVE-2026-116332 — postgresql: postgresql: Arbitrary code execution via use-after-free during portal setup CVE-2026-116333 — postgresql: postgresql: Information disclosure via buffer over-read in parallel B-tree scans CVE-2026-116335 — postgresql: PostgreSQL: Arbitrary code execution via operator link type confusion CVE-2026-116336 — postgresql: postgresql: Arbitrary code execution via dropped index in REINDEX CONCURRENTLY CVE-2026-120139 — postgresql: postgresql: Arbitrary code execution via integer wraparound in tuple-size calculations CVE-2026-120141 — postgresql: postgresql: Arbitrary code execution via type confusion in materialized set-returning functions CVE-2026-120142 — postgresql: postgresql: Arbitrary code execution via type confusion in anonymous RECORD types CVE-2026-120143 — postgresql: postgresql: Arbitrary code execution via use-after-free in trigger functions CVE-2026-120144 — postgresql: PostgreSQL: Arbitrary code execution via incomplete type-cache invalidation CVE-2026-120145 — postgresql: postgresql: Arbitrary code execution via system catalog replication target CVE-2026-120146 — postgresql: PostgreSQL: Authorization bypass via REASSIGN OWNED command CVE-2026-120147 — postgresql: postgresql: Arbitrary code execution via use-after-free in dblink extension CVE-2026-120148 — postgresql: postgresql: Arbitrary code execution via type confusion in extended statistics CVE-2026-120149 — postgresql: postgresql: Arbitrary code execution via foreign batch inserts CVE-2026-120150 — postgresql: postgresql: Arbitrary code execution via use-after-free in expanded-record domain checks CVE-2026-120151 — postgresql: postgresql: Arbitrary code execution via PL/pgSQL type confusion CVE-2026-120152 — postgresql: postgresql: Information disclosure via use-after-free in pg_show_all_settings() CVE-2026-120153 — postgresql: postgresql: arbitrary code execution via SQL injection in extension-script substitutions CVE-2026-120154 — postgresql: PostgreSQL: Row-level security bypass via INSERT ON CONFLICT DO UPDATE

🎯 Affected products8

  • Red Hat Hardened Images
  • libpq-0:18.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libpq-0:18.7-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • libpq-0:18.7-0.1.hum1@src as a component of Red Hat Hardened Images
  • libpq-0:18.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images
  • libpq-devel-0:18.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images
  • libpq-devel-0:18.7-0.1.hum1@s390x as a component of Red Hat Hardened Images
  • libpq-devel-0:18.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://images.redhat.com/ Workaround: Limit exposure to the PostgreSQL service by restricting network connectivity to trusted administrative hosts and revoking object-creation privileges from untrusted database accounts. 1. Restrict network reachability to trusted IP addresses using firewalld: ``` firewall-cmd --permanent --remove-service=postgresql firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_network> firewall-cmd --reload ``` 2. Revoke table creation privileges from untrusted database accounts within PostgreSQL: ``` REVOKE CREATE ON SCHEMA public FROM PUBLIC; ``` Caveats: Restricting network access prevents unapproved remote hosts from connecting to the database server. Revoking schema creation privileges may disrupt applications that require dynamic creation of temporary or permanent tables until explicit schema permissions are assigned. Warning: Reloading the firewall configuration using `firewall-cmd --reload` alters active packet filtering rules immediately and may disrupt existing network sessions. Workaround: Revoke database-level CREATE privileges from untrusted roles and restrict network access to the PostgreSQL service. To prevent non-superusers from creating schemas or installing extensions, revoke the database creation privilege in PostgreSQL: REVOKE CREATE ON DATABASE <database_name> FROM PUBLIC; REVOKE CREATE ON DATABASE <database_name> FROM <role_name>; Additionally, limit network exposure by restricting connections in pg_hba.conf to trusted hosts, or enforce firewall rules via firewalld: firewall-cmd --permanent --zone=public --remove-service=postgresql firewall-cmd --reload If modifying pg_hba.conf, apply configuration changes using: systemctl reload postgresql Warning: Reloading the service or applying firewall rules will alter network connectivity and may disconnect clients that are not explicitly permitted. Revoking the CREATE privilege prevents affected accounts from defining new schemas or managing extensions until granted by a superuser. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: 1. Revoke CREATE privileges on public and user schemas from untrusted database roles to prevent unauthorized function creation: REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE CREATE ON SCHEMA <schema_name> FROM <role_name>; 2. Restrict network access to the PostgreSQL service to trusted management networks or hosts using firewalld: firewall-cmd --permanent --remove-service=postgresql firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<trusted_ip_or_subnet>" service name="postgresql" accept' firewall-cmd --reload 3. Restrict database client access in /var/lib/pgsql/data/pg_hba.conf to trusted IP addresses only, then reload the database configuration: systemctl reload postgresql Caveats: Revoking schema creation privileges prevents affected database users from creating or altering functions, tables, or other objects, which may disrupt applications that rely on dynamic object definitions. Restricting network access or filtering client subnets prevents connections from unlisted hosts. Warning: Applying firewall changes or configuration changes requires reloading the firewall (`firewall-cmd --reload`) or the PostgreSQL service (`systemctl reload postgresql`), which may briefly disrupt active network connections or client sessions. Workaround: Restrict network access to the PostgreSQL service to trusted hosts and revoke schema creation permissions from untrusted database accounts. 1. Restrict PostgreSQL network exposure using firewalld to only authorized subnets: ``` firewall-cmd --permanent --remove-service=postgresql firewall-cmd --permanent --zone=trusted --add-source=<trusted_ip_or_subnet> firewall-cmd --permanent --zone=trusted --add-service=postgresql firewall-cmd --reload ``` 2. Restrict object creation privileges within the database: ``` REVOKE CREATE ON SCHEMA <schema_name> FROM <username>; ``` Caveats: Restricting network connectivity mitigates untrusted external exposure but does not prevent exploitation from authorized systems or accounts. Revoking schema creation privileges may break application workflows that require creating custom or temporary data types. Warning: Executing `firewall-cmd --reload` modifies active firewall rules and may temporarily interrupt active database connections. Workaround: To mitigate this vulnerability, disable the PL/Perl procedural language extension or remove its subpackage if PL/Perl functions are not required: 1. Drop the PL/Perl extension from affected databases: ```sql DROP EXTENSION IF EXISTS plperl CASCADE; DROP EXTENSION IF EXISTS plperlu CASCADE; ``` 2. Alternatively, revoke language usage privileges from untrusted roles: ```sql REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC; ``` 3. If PL/Perl is entirely unused across the host, uninstall the optional subpackage: ```sh # dnf remove postgresql-plperl ``` Caveats: - Dropping the extension or removing the subpackage will cause any database queries or stored procedures relying on PL/Perl to fail. - Using CASCADE will recursively drop all database objects (such as functions and triggers) that depend on PL/Perl. - Warning: Modifying system packages or stopping the database service for maintenance may require a service reload or restart (`systemctl restart postgresql`), which will disconnect active client sessions and cause temporary database unavailability. Workaround: Remove the optional dict_int extension from databases where it is not strictly required, or restrict database access to prevent untrusted users from querying dictionaries that rely on this module. To remove the extension from a specific database, execute the following SQL command as a superuser or database owner: DROP EXTENSION IF EXISTS dict_int CASCADE; Caveats: Dropping this extension removes any dependent full-text search configurations and will cause queries relying on dict_int to fail. Verify whether application schemas utilize this dictionary template prior to removal. Service impact: Executing this command takes effect immediately within the database; restarting or reloading the PostgreSQL service is not required. Workaround: If PL/Perl is not required, remove the extension from affected databases or uninstall the optional package. Alternatively, restrict language access so that unprivileged users cannot create PL/Perl functions. To remove the PL/Perl extension from a database: ```sql DROP EXTENSION IF EXISTS plperl CASCADE; ``` To revoke access to the language from general users while retaining it for administrators: ```sql REVOKE USAGE ON LANGUAGE plperl FROM PUBLIC; ``` To remove the PL/Perl package from the operating system: ```bash dnf remove postgresql-plperl ``` Caveats: Dropping the extension or uninstalling the package will prevent any existing PL/Perl functions from executing, which may disrupt applications that depend on them. Modifying database extensions takes effect immediately for connected sessions and does not require a service restart. Workaround: Do not process or restore archive files from untrusted or unverified sources using pg_restore. If processing an untrusted archive is unavoidable, execute pg_restore within an isolated, sandboxed environment, such as a disposable container or dedicated virtual machine, using an unprivileged user account. Caveat: Sandboxing restricts exposure on the host operating system, but does not prevent crafted archives from executing arbitrary SQL commands against the destination database during restoration. Workaround: Restrict network access to PostgreSQL to trusted hosts and clients only, limiting exposure to untrusted datab…

🔗 References (56)