Critical Security Flaw in PostgreSQL Packages: Important Update Required
Summary
ALSA-2026:4063: Important: postgresql:16 security update. Affects pg_repack across 2 version ranges.
< 1.5.1-1.module_el8.10.0+3930+ecf33554
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b
Fixed in 1.5.1-1.module_el8.10.0+3930+ecf33554 or 1.5.1-1.module_el8.10.0+4125+ceaf7d1b, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) that utilizes and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. However, recent vulnerabilities have been identified that could allow attackers to execute arbitrary code, posing significant risks to data integrity and system security.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include a missing validation of multibyte character length (CVE-2026-2006), a lack of input type validation in the intarray selectivity estimator (CVE-2026-2004), and a heap buffer overflow in pgcrypto (CVE-2026-2005). These flaws could allow attackers to execute arbitrary code, potentially leading to unauthorized access and manipulation of sensitive data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.5.1-1.module_el8.10.0+3930+ecf335541.5.1-1.module_el8.10.0+3930+ecf33554 -
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b1.5.1-1.module_el8.10.0+4125+ceaf7d1b
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can restrict access to the PostgreSQL database to trusted IP addresses only, thereby minimizing the risk of exploitation until the packages are updated.
Conclusion
The identified vulnerabilities in PostgreSQL packages pose serious security risks that could lead to arbitrary code execution. It is crucial for users to update their packages to the latest patched versions to mitigate these risks. Implementing temporary workarounds can help reduce exposure until updates are applied.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities involve missing validation checks that could allow attackers to execute arbitrary code.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring access to the code or installation.
Implement access restrictions to your PostgreSQL database to limit exposure until you can apply the updates.
While specific exploits may not be publicly available, the nature of the vulnerabilities poses a significant risk, and it is advisable to update as soon as possible.
Detailed information can be found on the CVE pages linked in the advisory, specifically CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
