Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:3730: Important: postgresql security update. Affects postgresql versions < 13.23-2.el9_7. Fixed in 13.23-2.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, concurrency, and complex queries. However, recent vulnerabilities have been identified that could allow unauthorized code execution, posing significant risks to data integrity and application security.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from inadequate validation of multibyte character lengths and input types in the intarray selectivity estimator, as well as a heap buffer overflow in pgcrypto. These issues could allow attackers to execute arbitrary code, potentially leading to unauthorized access and data manipulation. The specific vulnerabilities are tracked under CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006.
How To Fix
Minimum fixed version
13.23-2.el9_7
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users may restrict access to the PostgreSQL database to trusted IP addresses only, thereby minimizing the risk of exploitation until the update can be applied.
Conclusion
The identified vulnerabilities in PostgreSQL pose significant risks that require immediate attention. By updating to the latest patched version and implementing recommended security practices, users can protect their systems from potential exploitation.
See every vulnerability recorded for postgresql →
FAQ
The vulnerabilities include inadequate validation of multibyte character lengths, improper input type validation in the intarray selectivity estimator, and a heap buffer overflow in pgcrypto.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
Exploitation of these vulnerabilities could lead to arbitrary code execution, allowing attackers to gain unauthorized access to the database and manipulate or steal sensitive data.
Update to the patched version 13.23-2.el9_7 and consider implementing network restrictions to limit access to trusted sources.
Detailed information can be found on the CVE pages for CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
