Red Hat Security Advisory

RHSA-2026:4528

postgresql security update

Released 2026-03-12 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6.1, postgresql-private-devel-13.23-1.el9_6.1, postgresql-server-devel-13.23-1.el9_6.1 +4
Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6.1, postgresql-contrib-13.23-1.el9_6.1, postgresql-plperl-13.23-1.el9_6.1 +5

Fixes 3 records

TI-2026-01662 CVE-2026-2005 · GHSA-hgmp-6hmc-prfc

PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

MEDIUM 43

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01372 Published 2026-02-12 Partial fix · 18.2, 17.8 +3 CWE-122

TI-2026-01661 CVE-2026-2004 · GHSA-qw3h-8vxv-jf6c

PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code

MEDIUM 43

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01342 Published 2026-02-12 Partial fix · 18.2, 17.8 +3 CWE-1287

TI-2026-01663 CVE-2026-2006 · GHSA-mq5v-x68w-mc4f

PostgreSQL missing validation of multibyte character length executes arbitrary code

MEDIUM 42

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01162 Published 2026-02-12 Partial fix · 18.2, 17.8 +3 CWE-129