Red Hat Security Advisory

RHSA-2026:0525

postgresql16 security update

Released 2026-01-13 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.11-1.el10_1, postgresql-contrib-16.11-1.el10_1, postgresql-docs-16.11-1.el10_1 +12
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.11-1.el10_1

Fixes 2 records

TI-2025-11741 CVE-2025-12818 · GHSA-pr6x-gg24-6wfp

PostgreSQL libpq undersizes allocations, via integer wraparound

LOW 26

Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00364 Published 2025-11-13 Partial fix · 18.1, 17.7 +4 CWE-190

TI-2025-11740 CVE-2025-12817 · GHSA-99qj-9hw7-85x8

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

LOW 15

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.00243 Published 2025-11-13 Partial fix · 18.1, 17.7 +4 CWE-862