Critical Security Update for PostgreSQL: Arbitrary Code Execution Vulnerabilities
Summary
ALSA-2026:69876: Important: postgresql:16 security update. Affects pg_repack across 3 version ranges.
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b
< 1.5.1-1.module_el8.10.0+4199+bf03c564
< 1.5.1-1.module_el8.10.0+4286+3c445f53
Fixed in 1.5.1-1.module_el8.10.0+4125+ceaf7d1b, 1.5.1-1.module_el8.10.0+4199+bf03c564 or 1.5.1-1.module_el8.10.0+4286+3c445f53, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide range of data types and offers powerful features such as transactions, sub-selects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could allow arbitrary code execution, posing significant risks to data integrity and system security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various sources, including integer wraparound in tsvector and tsquery functions, untrusted data inclusion in pg_dump, and logical decoding plugins. These vulnerabilities can lead to arbitrary code execution, allowing attackers to manipulate database operations, execute unauthorized commands, and potentially gain control over the database server. The vulnerabilities are associated with multiple CVEs, including CVE-2026-14662, CVE-2026-18408, and CVE-2026-6464, among others.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.5.1-1.module_el8.10.0+4125+ceaf7d1b1.5.1-1.module_el8.10.0+4125+ceaf7d1b -
< 1.5.1-1.module_el8.10.0+4199+bf03c5641.5.1-1.module_el8.10.0+4199+bf03c564 -
< 1.5.1-1.module_el8.10.0+4286+3c445f531.5.1-1.module_el8.10.0+4286+3c445f53
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the PostgreSQL database and limit the use of untrusted data in database operations until the patches are applied. Additionally, consider disabling any features that utilize the affected functions until the update is completed.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that could lead to arbitrary code execution. It is crucial to update to the latest patched versions of the software to mitigate these risks. Implementing workarounds and monitoring tools like Vulert can help maintain security until updates are applied.
See every vulnerability recorded for pg_repack →
FAQ
PostgreSQL is an advanced object-relational database management system that provides a powerful, open-source platform for managing data.
The vulnerabilities can lead to arbitrary code execution, allowing attackers to manipulate database operations and potentially gain unauthorized access to sensitive data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
If immediate updates are not possible, restrict access to the database and limit the use of untrusted data until the vulnerabilities are patched.
For more details, refer to the CVE pages associated with the vulnerabilities, such as CVE-2026-14662 and CVE-2026-18408.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
