Critical Security Update for PostgreSQL: Addressing Timing Channel and Integer Overflow Vulnerabilities
Summary
ALSA-2026:28999: Important: postgresql:12 security update. Affects pg_repack versions < 1.4.6-3.module_el8.9.0+3704+f1f917ce. Fixed in 1.4.6-3.module_el8.9.0+3704+f1f917ce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers advanced features such as transactions, concurrency, and complex queries. However, recent vulnerabilities have been identified that could compromise its security, specifically related to credential recovery and memory management.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include a covert timing channel that allows for credential recovery via MD5 password comparison (CVE-2026-6478) and an integer overflow that can lead to an undersized allocation and an out-of-bounds write (CVE-2026-6473). These vulnerabilities can potentially allow an attacker to gain unauthorized access to sensitive information or cause application crashes, leading to service disruptions.
How To Fix
Minimum fixed version
1.4.6-3.module_el8.9.0+3704+f1f917ce
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing access controls to limit exposure to the database and monitor for unusual activity. Regularly review logs for any unauthorized access attempts.
Conclusion
In summary, the recent vulnerabilities in PostgreSQL highlight critical security concerns that need to be addressed promptly. Updating the affected packages is essential to mitigate risks and protect sensitive data. Users are encouraged to monitor their systems and apply the necessary updates as soon as possible.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities include a covert timing channel for credential recovery and an integer overflow that can lead to memory corruption.
You can use Vulert's playground at Vulert Scanner to check your application for these vulnerabilities without needing to sign up.
Exploitation of these vulnerabilities could lead to unauthorized access to sensitive data or application crashes, affecting service availability.
While the primary risks are unauthorized access and service disruption, there is a potential for data loss if an attacker exploits these vulnerabilities effectively.
Implement strict access controls, monitor logs for suspicious activity, and plan for an update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
