Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:67848: Important: postgresql:18 security update. Affects pg_repack versions < 1.5.3-1.module_el9.8.0+234+5456f35d. Fixed in 1.5.3-1.module_el9.8.0+234+5456f35d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, concurrency, and complex queries. However, recent vulnerabilities have been identified that could potentially allow unauthorized access and execution of arbitrary code, posing significant risks to data integrity and security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various sources, including SQL injection flaws, arbitrary code execution via untrusted data, and integer wraparound issues. These vulnerabilities can lead to severe consequences, such as unauthorized access to sensitive data, privilege escalation, and denial of service. Notably, CVE-2026-6476 allows for arbitrary SQL execution as a superuser, while CVE-2026-18408 enables arbitrary code execution through crafted pg_dump operations.
How To Fix
Minimum fixed version
1.5.3-1.module_el9.8.0+234+5456f35d
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the database and limiting the execution of untrusted data until the packages can be updated. This can be done by modifying user permissions and implementing stricter access controls.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that require immediate attention. Updating to the latest patched versions of the affected packages is essential to mitigate risks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities include SQL injection, arbitrary code execution, and integer wraparound issues, among others.
You can use Vulert's playground at Vulert Scanner to check your application against known vulnerabilities without any signup.
The impact can range from unauthorized access to sensitive data to complete system compromise and denial of service.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
Implement access restrictions and limit the execution of untrusted data as a temporary workaround until updates can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
