Red Hat Security Advisory

RHSA-2026:0266

postgresql:15 security update

Released 2026-01-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19

Fixes 2 records

TI-2025-11741 CVE-2025-12818 · GHSA-pr6x-gg24-6wfp

PostgreSQL libpq undersizes allocations, via integer wraparound

LOW 26

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00364 Published 2025-11-13 Partial fix · 18.1, 17.7 +4 CWE-190

TI-2025-11740 CVE-2025-12817 · GHSA-99qj-9hw7-85x8

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

LOW 15

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00243 Published 2025-11-13 Partial fix · 18.1, 17.7 +4 CWE-862