Read the docs
TI-2026-05677 Aliases CVE-2026-6477GHSA-jm5f-gpfq-q9h3

PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

Priority MEDIUM 40CWE-242Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 27 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00454 39th percentileScored 2026-11-07
Fix Partial PostgreSQL: 18.4, 17.10, 16.14 +2Red Hat: 54 advisoriesRed Hat: 27 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL18 to before 18.4; 17 to before 17.10; 16 to before 16.14; 15 to before 15.18; before 14.2318.4, 17.10, 16.14, 15.18, 14.23Patch availableCNA
  • PostgreSQL Vendor— Affected 18 to before 18.4; 17 to before 17.10; 16 to before 16.14; 15 to before 15.18; before 14.23 Fixed in 18.4, 17.10, 16.14, 15.18, 14.23 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*before 14.23; 15.0 to before 15.18; 16.0 to before 16.14; 17.0 to before 17.10; 18.0 to before 18.4VulnerablePostgreSQL
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* Versions before 14.23; 15.0 to before 15.18; 16.0 to before 16.14; 17.0 to before 17.10; 18.0 to before 18.4 Vulnerable ·PostgreSQL

Remediation

  • Fix · CNA PostgreSQL Fixed in 18.4, 17.10, 16.14, 15.18, 14.23

Red Hat 54 advisories

  • RHSA-2026:74674 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.4.3 (Neuron)
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhai/base-image-neuron-rhel9
  • RHSA-2026:74463 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 7.0)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74462 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CUDA 12.9)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cuda-rhel9
Show 51 more Red Hat advisories
  • RHSA-2026:74461 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (Spyre)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:74460 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (CPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:74459 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (ROCm 6.4)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:74458 Released 2026-10-01 · Red Hat rating Important
    Red Hat AI Base Images 3.2.3 (TPU)
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73962 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cuda)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cuda-rhel9
  • RHSA-2026:73961 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (spyre)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-spyre-rhel9
  • RHSA-2026:73960 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (cpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-cpu-rhel9
  • RHSA-2026:73959 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (tpu)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-tpu-rhel9
  • RHSA-2026:73909 Released 2026-09-30 · Red Hat rating Important
    Red Hat AI Base Images 3.0.3 (rocm)
    • Red Hat OpenShift AI 3.0 registry.redhat.io/rhai/base-image-rocm-rhel9
  • RHSA-2026:58981 Released 2026-08-24 · Red Hat rating Critical
    Red Hat Update Infrastructure 5.3 Technology Preview security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
  • RHSA-2026:54760 Released 2026-08-13 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:50863 Released 2026-08-05 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) libpq-devel-16.14-0.el10_0.1
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) libpq-16.14-0.el10_0.1
  • RHSA-2026:50779 Released 2026-08-05 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) libpq-13.23-1.el9_6.1, libpq-devel-13.23-1.el9_6.1
  • RHSA-2026:49909 Released 2026-08-04 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) libpq-13.23-1.el9_4.1, libpq-devel-13.23-1.el9_4.1
  • RHSA-2026:49908 Released 2026-08-04 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) libpq-13.23-1.el9_2.1, libpq-devel-13.23-1.el9_2.1
  • RHSA-2026:49521 Released 2026-08-03 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) postgresql-9.2.24-9.el7_9.6, postgresql-9.2.24-9.el7_9.6.ppc, postgresql-contrib-9.2.24-9.el7_9.6 +10
    • Red Hat Enterprise Linux Server Optional (v. 7 ELS) postgresql-static-9.2.24-9.el7_9.6, postgresql-static-9.2.24-9.el7_9.6.ppc, postgresql-upgrade-9.2.24-9.el7_9.6
  • RHSA-2026:47090 Released 2026-07-28 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) libpq-13.23-1.el8_6.1, libpq-devel-13.23-1.el8_6.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) libpq-13.23-1.el8_6.1, libpq-devel-13.23-1.el8_6.1
  • RHSA-2026:44481 Released 2026-07-23 · Red Hat rating Important
    Red Hat Update Infrastructure 5.2 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-rhel9, registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9 +2
  • RHSA-2026:44391 Released 2026-07-23 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 10) libpq-devel-16.14-1.el10_2
    • Red Hat Enterprise Linux BaseOS (v. 10) libpq-16.14-1.el10_2
  • RHSA-2026:44420 Released 2026-07-23 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) libpq-13.23-1.el8_4.1, libpq-devel-13.23-1.el8_4.1
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) libpq-13.23-1.el8_4.1, libpq-devel-13.23-1.el8_4.1
  • RHSA-2026:44308 Released 2026-07-23 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 9) libpq-13.23-3.el9_8, libpq-devel-13.23-3.el9_8
  • RHSA-2026:42555 Released 2026-07-21 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:35880 Released 2026-07-06 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) libpq-13.23-1.el8_8.1, libpq-devel-13.23-1.el8_8.1
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) libpq-13.23-1.el8_8.1, libpq-devel-13.23-1.el8_8.1
  • RHSA-2026:34362 Released 2026-07-01 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.src::postgresql:12, pgaudit-1.4.0-6.module+el8.4.0+11288+c193d6d7.x86_64::postgresql:12, postgres-decoderbufs-0.10.0-2.module+el8.4.0+11288+c193d6d7.src::postgresql:12 +15
  • RHSA-2026:34363 Released 2026-07-01 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2026:34043 Released 2026-07-01 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
  • RHSA-2026:33497 Released 2026-06-30 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:33441 Released 2026-06-30 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2026:32983 Released 2026-06-29 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2026:32994 Released 2026-06-29 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:29953 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.23-1.el9_2.2, postgresql-contrib-13.23-1.el9_2.2, postgresql-plperl-13.23-1.el9_2.2 +5
  • RHSA-2026:29904 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) postgresql-13.23-1.el9_4.2, postgresql-contrib-13.23-1.el9_4.2, postgresql-plperl-13.23-1.el9_4.2 +5
  • RHSA-2026:29815 Released 2026-06-25 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.src::postgresql:12, pg_repack-1.4.6-3.module+el8.5.0+11354+78b3c9c5.x86_64::postgresql:12, pgaudit-1.4.0-5.module+el8.5.0+11354+78b3c9c5.src::postgresql:12 +17
  • RHSA-2026:29212 Released 2026-06-25 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6.2, postgresql-private-devel-13.23-1.el9_6.2, postgresql-server-devel-13.23-1.el9_6.2 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6.2, postgresql-contrib-13.23-1.el9_6.2, postgresql-plperl-13.23-1.el9_6.2 +5
  • RHSA-2026:28999 Released 2026-06-24 · Red Hat rating Important
    postgresql:12 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.aarch64::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.ppc64le::postgresql:12, pg_repack-1.4.6-3.module+el8.9.0+19330+c97ddbdf.s390x::postgresql:12 +47
  • RHSA-2026:28208 Released 2026-06-23 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
  • RHSA-2026:28143 Released 2026-06-23 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2026:28037 Released 2026-06-22 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.8.0+24091+17775505.s390x::postgresql:15 +47
  • RHSA-2026:27741 Released 2026-06-22 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.23-3.el9_8, postgresql-contrib-13.23-3.el9_8, postgresql-plperl-13.23-3.el9_8 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.23-3.el9_8, postgresql-private-devel-13.23-3.el9_8, postgresql-server-devel-13.23-3.el9_8 +4
  • RHSA-2026:27742 Released 2026-06-22 · Red Hat rating Important
    postgresql18 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql18-18.4-1.el10_2, postgresql18-contrib-18.4-1.el10_2, postgresql18-docs-18.4-1.el10_2 +10
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql18-test-rpm-macros-18.4-1.el10_2
  • RHSA-2026:27743 Released 2026-06-22 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.14-1.el10_2, postgresql-contrib-16.14-1.el10_2, postgresql-docs-16.14-1.el10_2 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.14-1.el10_2
  • RHSA-2026:27718 Released 2026-06-22 · Red Hat rating Important
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-16.14-1.el10_0, postgresql-contrib-16.14-1.el10_0, postgresql-docs-16.14-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) postgresql-test-rpm-macros-16.14-1.el10_0
  • RHSA-2026:27738 Released 2026-06-22 · Red Hat rating Important
    libpq security update
    • Red Hat Enterprise Linux AppStream (v. 8) libpq-13.23-2.el8_10, libpq-devel-13.23-2.el8_10
  • RHSA-2026:26561 Released 2026-06-17 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2026:26525 Released 2026-06-17 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:26524 Released 2026-06-17 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2026:26204 Released 2026-06-16 · Red Hat rating Important
    postgresql:18 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.aarch64::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.ppc64le::postgresql:18, pg_repack-1.5.3-1.module+el9.8.0+23739+1c42644c.s390x::postgresql:18 +47
  • RHSA-2026:26203 Released 2026-06-16 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.s390x::postgresql:16 +47
  • RHSA-2026:26181 Released 2026-06-16 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2026:22878 Released 2026-06-03 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql-18.4-0.1.hum1@aarch64, postgresql-18.4-0.1.hum1@x86_64, postgresql-contrib-18.4-0.1.hum1@aarch64 +26
  • RHSA-2026:21182 Released 2026-05-26 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql17-17.10-0.1.hum1@aarch64, postgresql17-17.10-0.1.hum1@src, postgresql17-17.10-0.1.hum1@x86_64 +28

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 14.23, 15.18 and 3 more versions

    8 records Highest priority Priority MEDIUM 5 MEDIUM, 3 LOW

    Other records, highest priority first

    • TI-2026-05673 PostgreSQL server undersizes allocations, via integer wraparoundPriority MEDIUM 42
    • TI-2026-05824 PostgreSQL refint allows stack buffer overflow and SQL injectionPriority MEDIUM 40
    • TI-2026-05679 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursionPriority MEDIUM 40
    Show all 8 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Self-service automation portal 2AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:29212
Red Hat Discovery 2Fixed RHSA-2026:54760
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:27742, RHSA-2026:27743, RHSA-2026:44391
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:26181, RHSA-2026:27738, RHSA-2026:28143, RHSA-2026:28208, RHSA-2026:28999
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:26203, RHSA-2026:26204, RHSA-2026:27741, RHSA-2026:28037, RHSA-2026:44308
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:34362, RHSA-2026:34363, RHSA-2026:44420
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:29815, RHSA-2026:32994, RHSA-2026:47090
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:26561, RHSA-2026:34043, RHSA-2026:35880, RHSA-2026:42555
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:29953, RHSA-2026:33497, RHSA-2026:49908
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:26524, RHSA-2026:29904, RHSA-2026:33441, RHSA-2026:49909
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:27718, RHSA-2026:50863
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:26525, RHSA-2026:29212, RHSA-2026:32983, RHSA-2026:50779
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:34362, RHSA-2026:34363, RHSA-2026:44420
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:29815, RHSA-2026:32994, RHSA-2026:47090
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:26561, RHSA-2026:34043, RHSA-2026:35880, RHSA-2026:42555
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:44391
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:50863
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:27742, RHSA-2026:27743
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:27741
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:27718
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:49521
Red Hat Enterprise Linux Server Optional (v. 7 ELS)Fixed RHSA-2026:49521
Red Hat Hardened ImagesFixed RHSA-2026:21182, RHSA-2026:22878
Red Hat OpenShift AI 3.0Fixed RHSA-2026:73909, RHSA-2026:73959, RHSA-2026:73960, RHSA-2026:73961, RHSA-2026:73962
Red Hat OpenShift AI 3.2Fixed RHSA-2026:74458, RHSA-2026:74459, RHSA-2026:74460, RHSA-2026:74461, RHSA-2026:74462, RHSA-2026:74463
Red Hat OpenShift AI 3.4Fixed RHSA-2026:74674
Red Hat Update Infrastructure 5Fixed RHSA-2026:44481, RHSA-2026:58981
Not affected: 4 products
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 8
  • Red Hat Hardened Images
  • Red Hat Update Infrastructure 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-6477
  2. 2026-10-03 Alias added: GHSA-jm5f-gpfq-q9h3

References

Patch 1

  • TI-2019-06651 In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and… CVSS 3.0HIGH 7.2
  • TI-2017-05187 Improper authentication in postgresql CVSS 3.0CRITICAL 9.8
  • TI-2020-15711 SQL injection in postgresql CVSS 3.1HIGH 8.8
  • TI-2013-01675 Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9… CVSS 2.0MEDIUM 6.5
  • TI-2007-03176 The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE… CVSS 2.0HIGH 9.0
  • TI-2022-01423 SQL injection in postgresql CVSS 3.1HIGH 8.8
See all 202 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences