Critical Security Update for PostgreSQL 18: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:27742: Important: postgresql18 security update. Affects postgresql18 versions < 18.4-1.el10_2. Fixed in 18.4-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source Object-Relational Database Management System (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide variety of data types and offers advanced features such as transactions, sub-selects, triggers, views, and stored procedures. The recent vulnerabilities identified in PostgreSQL 18 pose significant risks, including potential account hijacking and memory corruption, necessitating immediate attention from users and administrators.
Vulnerability Detail
The vulnerabilities in PostgreSQL 18 include an operating system account hijack via symlink in pg_basebackup and pg_rewind (CVE-2026-6475), a buffer overflow that allows a server superuser to overwrite client stack memory (CVE-2026-6477), credential recovery through a covert timing channel in MD5 password comparison (CVE-2026-6478), and an integer overflow that can lead to an undersized allocation and out-of-bounds write (CVE-2026-6473). These vulnerabilities can lead to unauthorized access, data corruption, and potential system compromise.
How To Fix
Minimum fixed version
18.4-1.el10_2
This is the first release that contains the fix.
sudo dnf update postgresql18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to restrict access to the PostgreSQL server and limit the use of pg_basebackup and pg_rewind until the update can be applied. Additionally, consider using alternative authentication methods to mitigate the risks associated with the vulnerabilities.
Conclusion
The vulnerabilities identified in PostgreSQL 18 present serious security risks that require immediate attention. Users are strongly encouraged to update to the latest patched version to protect their systems from potential exploits. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for postgresql18 →
FAQ
PostgreSQL is an advanced open-source Object-Relational Database Management System that supports a wide range of data types and offers powerful features for data management.
The vulnerabilities can lead to unauthorized access, data corruption, and potential system compromise, impacting the integrity and security of the database.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Check your application against the vulnerabilities using the Vulert playground at Vulert Scanner.
Yes, a patch is available in the form of version 18.4-1.el10_2. It is recommended to update to this version to mitigate the vulnerabilities.
If immediate updating is not possible, restrict access to the PostgreSQL server and limit the use of vulnerable features as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql18.
