Critical Security Update for libpq: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:27738: Important: libpq security update. Affects libpq versions < 13.23-2.el8_10. Fixed in 13.23-2.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libpq package is the PostgreSQL client library that enables client applications to connect to PostgreSQL servers. It is a critical component for database interactions, providing essential functionalities such as executing SQL commands and managing database connections. Given its widespread use in applications that rely on PostgreSQL, any vulnerabilities within libpq can have significant implications for data security and application integrity.
Vulnerability Detail
This security update addresses multiple vulnerabilities in the libpq package. The vulnerabilities include an operating system account hijack via symlink in pg_basebackup and pg_rewind (CVE-2026-6475), a buffer overflow that allows a server superuser to overwrite client stack memory (CVE-2026-6477), a covert timing channel in MD5 password comparison that can lead to credential recovery (CVE-2026-6478), and an integer overflow that can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473). These vulnerabilities can lead to unauthorized access, data corruption, and potential system compromise.
How To Fix
Minimum fixed version
13.23-2.el8_10
This is the first release that contains the fix.
sudo dnf update libpqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the PostgreSQL server and limit the use of the affected functionalities until the package is updated. Additionally, consider implementing stricter file permissions to prevent unauthorized symlink creation.
Conclusion
The libpq package has critical vulnerabilities that require immediate attention. Updating to the latest patched version is essential to protect your applications and data from potential threats. Implementing workarounds can provide temporary relief, but a full update is the best course of action.
See every vulnerability recorded for libpq →
FAQ
libpq is the PostgreSQL client library that allows applications to connect and interact with PostgreSQL databases.
The vulnerabilities can lead to unauthorized access, data breaches, and potential system compromise, affecting the integrity and confidentiality of your data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider implementing workarounds such as restricting access to the PostgreSQL server and enhancing file permissions.
For more details, refer to the CVE pages listed in the advisory or consult the official PostgreSQL documentation.
Related vulnerabilities
Recent vulnerabilities recorded for libpq.
