Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:27741: Important: postgresql security update. Affects postgresql versions < 13.23-3.el9_8. Fixed in 13.23-3.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, extensibility, and SQL compliance. It is widely used for managing large datasets and supports various programming languages. However, recent vulnerabilities have been identified that could potentially compromise the security of PostgreSQL installations, particularly in version 13.23 and earlier.
Vulnerability Detail
The vulnerabilities in PostgreSQL include an operating system account hijack via symlink in pg_basebackup and pg_rewind (CVE-2026-6475), a buffer overflow that allows a server superuser to overwrite client stack memory (CVE-2026-6477), credential recovery through a covert timing channel in MD5 password comparison (CVE-2026-6478), and an integer overflow that can lead to an undersized allocation and out-of-bounds write (CVE-2026-6473). These vulnerabilities can lead to unauthorized access, data corruption, and potential system compromise.
How To Fix
Minimum fixed version
13.23-3.el9_8
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the PostgreSQL server and limit the use of symlinks in backup processes until the update is applied.
Conclusion
In summary, PostgreSQL has critical vulnerabilities that need immediate attention. Users are advised to update to the latest patched version to ensure the security and integrity of their database systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for postgresql →
FAQ
The main vulnerabilities include account hijacking via symlink, buffer overflow, credential recovery through timing channels, and integer overflow leading to out-of-bounds writes.
You can verify if your installation is affected by using tools like Vulert, which monitors open-source vulnerabilities in real-time based on your manifest file.
It is recommended to upgrade to version 13.23-3.el9_8 to mitigate the identified vulnerabilities.
Yes, not updating could expose your system to unauthorized access, data corruption, and other security risks.
Yes, Vulert allows you to monitor vulnerabilities using just a manifest file like package-lock.json, without requiring installation.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
