Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:27743: Important: postgresql16 security update. Affects postgresql versions < 16.14-1.el10_2. Fixed in 16.14-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is an advanced Object-Relational Database Management System (DBMS) known for its robustness, extensibility, and standards compliance. It allows users to create and manage databases efficiently, supporting various data types and complex queries. However, recent vulnerabilities have been identified that could compromise the security of PostgreSQL installations, particularly affecting the core functionalities and user data integrity.
Vulnerability Detail
The vulnerabilities in PostgreSQL stem from various issues, including operating system account hijacking via symlink in pg_basebackup and pg_rewind, a buffer overflow in libpq that allows server superusers to overwrite client stack memory, and a covert timing channel in MD5 password comparison that could lead to credential recovery. Additionally, an integer overflow could result in an undersized allocation and an out-of-bounds write, posing significant risks to data security and application stability.
How To Fix
Minimum fixed version
16.14-1.el10_2
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider restricting access to the PostgreSQL server and monitoring logs for unusual activities. Additionally, ensure that proper permissions are set for database files to mitigate the risk of symlink attacks.
Conclusion
In summary, PostgreSQL has been identified with critical vulnerabilities that require immediate attention. Updating to the latest patched version is crucial to maintaining the security and integrity of your database systems. Users should also consider implementing workarounds while planning for updates.
See every vulnerability recorded for postgresql →
FAQ
The main vulnerabilities include operating system account hijacking, buffer overflow, credential recovery via timing channels, and integer overflow leading to out-of-bounds writes.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you cannot update immediately, restrict access to your PostgreSQL server and monitor logs for any suspicious activities to minimize risks.
CVE identifiers (Common Vulnerabilities and Exposures) provide a reference for publicly known cybersecurity vulnerabilities, allowing users to track and address specific issues.
For more details about the security issues, including their impact and CVSS scores, refer to the CVE pages listed in the related section of the vulnerability report.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
