Critical Security Update for PostgreSQL: Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:69923: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.9.0+3706+885c732e. Fixed in 1.4.8-1.module_el8.9.0+3706+885c732e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, subselects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow arbitrary code execution, posing significant risks to applications relying on this database.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various issues including integer wraparound in tsvector and tsquery functions, untrusted data inclusion in pg_dump, and heap buffer overflows. These vulnerabilities can lead to arbitrary code execution, allowing attackers to execute malicious commands, potentially compromising the entire database and the applications that depend on it. Specific CVEs related to this update include CVE-2026-14662, CVE-2026-18408, and CVE-2026-6464, among others.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.9.0+3706+885c732e
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider restricting access to the PostgreSQL database and disabling any unnecessary features that could be exploited. Regularly monitor logs for unusual activity and implement network security measures to limit exposure.
Conclusion
The recent vulnerabilities in PostgreSQL highlight the importance of maintaining up-to-date software to protect against potential exploits. By applying the necessary updates and following best practices for database security, users can significantly reduce their risk of compromise.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities allow for arbitrary code execution due to issues like integer wraparound and untrusted data handling.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Implement workarounds such as restricting database access and monitoring logs for suspicious activity until you can apply the updates.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited by attackers to execute arbitrary code.
It is recommended to regularly check for updates and apply them promptly to mitigate security risks.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
