Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:4059: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.9.0+3706+885c732e. Fixed in 1.4.8-1.module_el8.9.0+3706+885c732e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its reliability, feature robustness, and performance. It supports advanced data types and offers extensive functionality for data management. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code, compromising the integrity and security of the database.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from inadequate validation processes. Specifically, CVE-2026-2006 involves a lack of validation for multibyte character lengths, which can lead to arbitrary code execution. CVE-2026-2004 relates to the intarray module, where improper validation of input types for the selectivity estimator can also result in arbitrary code execution. Additionally, CVE-2026-2005 describes a heap buffer overflow in the pgcrypto module, further exposing the system to potential exploitation.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.9.0+3706+885c732e
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the PostgreSQL database and monitoring logs for any suspicious activity until the update can be applied.
Conclusion
The recent vulnerabilities in PostgreSQL highlight the importance of maintaining up-to-date software to protect against potential exploits. By applying the recommended updates and monitoring your systems, you can significantly reduce the risk of security breaches.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities include inadequate validation of multibyte character lengths, improper input type validation in the intarray module, and a heap buffer overflow in the pgcrypto module.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
It is recommended to update PostgreSQL and its related packages to the latest patched versions as soon as possible.
Failure to address these vulnerabilities could lead to arbitrary code execution, potentially allowing attackers to gain unauthorized access to your database and its data.
Yes, temporarily restrict access to the database and monitor logs for any unusual activity until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
