Critical Security Update for PostgreSQL: Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:69924: Important: postgresql:12 security update. Affects pg_repack versions < 1.4.6-3.module_el8.9.0+3704+f1f917ce. Fixed in 1.4.6-3.module_el8.9.0+3704+f1f917ce. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow arbitrary code execution, posing significant risks to data integrity and security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various issues, including integer wraparound in tsvector and tsquery functions, untrusted data handling in COPY FROM STDIN, and type confusion with internal arguments. These vulnerabilities could lead to arbitrary code execution, allowing attackers to manipulate the database and potentially gain unauthorized access to sensitive information. The vulnerabilities are tracked under multiple CVEs, including CVE-2026-14662, CVE-2026-6464, and CVE-2026-14680, among others.
How To Fix
Minimum fixed version
1.4.6-3.module_el8.9.0+3704+f1f917ce
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the database and monitoring for unusual activity. Implementing strict input validation and sanitization for user inputs can also help mitigate risks until the packages are updated.
Conclusion
The identified vulnerabilities in PostgreSQL present serious security risks that require immediate attention. By updating to the latest patched versions and implementing recommended workarounds, organizations can protect their data and maintain the integrity of their database systems.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities allow for arbitrary code execution, which can lead to unauthorized access and manipulation of the database.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file. Visit Vulert Scanner to check your application without needing to sign up.
Implement access restrictions and monitor for unusual activity as a temporary measure until you can apply the updates.
Versions 12.22-10.module_el8.10.0+4290+614f71e9 and later have patched the vulnerabilities. Ensure you are running these or newer versions.
Failure to address these vulnerabilities could lead to data breaches, unauthorized access, and significant damage to your organization's data integrity and reputation.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
