Critical Security Update for PostgreSQL: Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:67491: Important: postgresql:16 security update. Affects pg_repack versions < 1.5.1-1.module_el9.6.0+146+c54fdeca. Fixed in 1.5.1-1.module_el9.6.0+146+c54fdeca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide range of data types and offers powerful features such as complex queries, transactions, and concurrency control. However, recent vulnerabilities have been identified that could allow arbitrary code execution, posing significant risks to data integrity and system security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various sources, including integer wraparound in tsvector and tsquery functions, untrusted data inclusion in pg_dump, and type confusion in several modules. These vulnerabilities can lead to arbitrary code execution, allowing attackers to manipulate database operations and potentially gain unauthorized access to sensitive data. The technical aspects include heap buffer overflows, stack buffer overflows, and privilege escalation through SQL injection, all of which can severely compromise the database's security.
How To Fix
Minimum fixed version
1.5.1-1.module_el9.6.0+146+c54fdeca
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting access to the PostgreSQL database and disabling any untrusted data sources until the packages can be updated. Additionally, review and sanitize any user inputs to mitigate the risk of SQL injection attacks.
Conclusion
The identified vulnerabilities in PostgreSQL present significant risks that can lead to arbitrary code execution and data breaches. It is essential to update affected packages promptly and implement recommended workarounds to safeguard your database environment.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities allow for arbitrary code execution due to flaws in various functions and modules, which can be exploited by attackers.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Implement temporary workarounds such as restricting database access and sanitizing user inputs to reduce the risk of exploitation.
Yes, versions prior to the patched versions specified in the advisory are vulnerable. Ensure you update to the latest versions.
Failure to address these vulnerabilities can lead to unauthorized access, data manipulation, and severe security breaches.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
