Critical Security Update for PostgreSQL: Addressing Timing Channel and Integer Overflow Vulnerabilities
Summary
ALSA-2026:26181: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.9.0+3706+885c732e. Fixed in 1.4.8-1.module_el8.9.0+3706+885c732e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its reliability, feature robustness, and performance. It supports advanced data types and offers extensive SQL compliance. However, recent vulnerabilities have been identified that could compromise its security, specifically related to credential recovery and memory allocation issues.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include a covert timing channel in MD5 password comparison (CVE-2026-6478) that could allow attackers to recover credentials, and an integer overflow issue (CVE-2026-6473) that may lead to undersized memory allocation and potential out-of-bounds writes. These vulnerabilities can have severe implications, including unauthorized access to sensitive data and system instability.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.9.0+3706+885c732e
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider disabling MD5 password authentication until the update can be applied. This can be done by modifying the pg_hba.conf file and changing the authentication method for affected users to 'trust' or 'scram-sha-256'. However, this is not a long-term solution and should be followed by an update as soon as possible.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that require immediate attention. Updating to the latest patched versions is essential to ensure the security and stability of your database systems. Utilize tools like Vulert to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pg_repack →
FAQ
The main vulnerabilities are a covert timing channel in MD5 password comparison and an integer overflow that can lead to memory allocation issues.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
All versions prior to the patched versions specified in the update are affected. Ensure you update to at least version 15.18-1.module_el8.10.0+4195+4569d728.
As a temporary workaround, consider disabling MD5 password authentication in your configuration until you can apply the update.
For more details, refer to the CVE pages: CVE-2026-6478 and CVE-2026-6473.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
