Critical Security Update for PostgreSQL: Addressing Timing Channel and Integer Overflow Vulnerabilities
Summary
ALSA-2026:28143: Important: postgresql:16 security update. Affects pg_repack across 3 version ranges.
< 1.5.1-1.module_el8.10.0+3930+ecf33554
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b
< 1.5.1-1.module_el8.10.0+4199+bf03c564
Fixed in 1.5.1-1.module_el8.10.0+3930+ecf33554, 1.5.1-1.module_el8.10.0+4125+ceaf7d1b or 1.5.1-1.module_el8.10.0+4199+bf03c564, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, scalability, and support for advanced data types. It is widely used in various applications, from small projects to large enterprise systems. The recent vulnerabilities identified in PostgreSQL could potentially compromise the security of applications relying on this database, making it crucial for users to stay informed and updated.
Vulnerability Detail
The vulnerabilities in PostgreSQL include a covert timing channel in MD5 password comparison (CVE-2026-6478) that could allow attackers to recover credentials, and an integer overflow issue (CVE-2026-6473) that may lead to undersized allocations and out-of-bounds writes. These vulnerabilities can result in unauthorized access to sensitive data and system instability, posing significant risks to users and applications.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.5.1-1.module_el8.10.0+3930+ecf335541.5.1-1.module_el8.10.0+3930+ecf33554 -
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b1.5.1-1.module_el8.10.0+4125+ceaf7d1b -
< 1.5.1-1.module_el8.10.0+4199+bf03c5641.5.1-1.module_el8.10.0+4199+bf03c564
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can limit access to the database and implement additional security measures such as using stronger password hashing algorithms instead of MD5. However, this is not a substitute for applying the security updates.
Conclusion
The identified vulnerabilities in PostgreSQL highlight the importance of maintaining up-to-date software to safeguard against potential security threats. Users are strongly encouraged to apply the necessary updates and consider additional security measures to protect their systems.
See every vulnerability recorded for pg_repack →
FAQ
The main vulnerabilities include a covert timing channel in MD5 password comparison and an integer overflow that can lead to out-of-bounds writes.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any installation.
If immediate updates are not possible, implement stricter access controls and consider using stronger password hashing methods as a temporary workaround.
Yes, you should update PostgreSQL and its related packages such as pg_repack, pgaudit, and others listed in the update command.
These vulnerabilities can lead to unauthorized access to sensitive data and system instability, posing significant risks to applications using PostgreSQL.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
