Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:4024: Important: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.6.0+3095+ee60d910
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.6.0+3095+ee60d910, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system known for its robustness, extensibility, and standards compliance. It supports a wide variety of workloads, from single machines to data warehouses or web services with many concurrent users. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code, posing significant risks to data integrity and system security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from insufficient validation of multibyte character lengths, improper type validation in the intarray selectivity estimator, and a heap buffer overflow in the pgcrypto module. These flaws can lead to arbitrary code execution, potentially allowing attackers to manipulate database operations, access sensitive data, or disrupt service availability. The vulnerabilities are tracked under CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.6.0+3095+ee60d9101.4.6-3.module_el8.6.0+3095+ee60d910
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, if you cannot apply the updates immediately, consider restricting access to the database and monitoring for unusual activity. Implementing strict user permissions and regularly auditing database logs can help mitigate risks until the vulnerabilities are patched.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that require immediate attention to prevent potential exploitation. Updating to the latest patched versions is essential for maintaining database security. Utilize tools like Vulert to monitor your applications for vulnerabilities effectively.
See every vulnerability recorded for pg_repack →
FAQ
The main vulnerabilities include insufficient validation of multibyte character lengths, improper type validation in the intarray selectivity estimator, and a heap buffer overflow in the pgcrypto module.
These vulnerabilities can allow attackers to execute arbitrary code, potentially leading to unauthorized access, data manipulation, or service disruption.
The vulnerabilities affect PostgreSQL version 13 and its associated packages in AlmaLinux 8.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
If immediate updates are not possible, restrict database access and monitor for unusual activity as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
