Critical Security Update for PostgreSQL: Addressing Multiple Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:69914: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-2.module_el9.5.0+119+18833d03. Fixed in 1.4.8-2.module_el9.5.0+119+18833d03. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code, posing significant risks to data integrity and system security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various issues, including integer wraparound in tsvector and tsquery functions, untrusted data inclusion in pg_dump, and heap buffer overflows. These vulnerabilities can lead to arbitrary code execution, allowing attackers to manipulate the database, escalate privileges, or execute malicious commands. The vulnerabilities are associated with multiple CVEs, including CVE-2026-14662, CVE-2026-18408, and CVE-2026-6464, among others.
How To Fix
Minimum fixed version
1.4.8-2.module_el9.5.0+119+18833d03
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the PostgreSQL server and disabling any untrusted functions or features that may be exploited until the update can be applied.
Conclusion
The identified vulnerabilities in PostgreSQL pose significant security risks that require immediate attention. By updating to the latest patched versions and implementing recommended workarounds, users can mitigate the potential impact of these vulnerabilities.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities involve arbitrary code execution due to issues like integer wraparound, untrusted data inclusion, and buffer overflows.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application's manifest file.
Exploitation of these vulnerabilities can lead to unauthorized access, data manipulation, privilege escalation, and potential system compromise.
Yes, ensure that you upgrade to the specified patched versions for each affected package as listed in the 'how_to_fix' section.
Consider implementing temporary workarounds such as restricting access to the PostgreSQL server and disabling vulnerable features.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
