Critical Security Update for PostGIS: CVE-2026-73515
Summary
RHSA-2026:65899: Red Hat Security Advisory: postgresql16-postgis security update. Affects postgis versions < 0:3.5.3-4.el10_2.1. Fixed in 0:3.5.3-4.el10_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostGIS is an extension for PostgreSQL that adds support for geographic objects, allowing location queries to be run in SQL. It is widely used in geographic information systems (GIS) and spatial databases. The recent vulnerability identified as CVE-2026-73515 affects multiple packages within the PostGIS ecosystem, including postgis, postgis-client, and others, potentially exposing systems to security risks.
Vulnerability Detail
The vulnerability CVE-2026-73515 arises from a flaw in the PostGIS extension that could allow an attacker to exploit the system through crafted SQL queries. This could lead to unauthorized access to sensitive data or even system compromise. The CVSS score for this vulnerability is 8.1, indicating a high severity level. It is crucial for users of affected packages to address this vulnerability promptly to mitigate risks.
How To Fix
Minimum fixed version
0:3.5.3-4.el10_2.1
This is the first release that contains the fix.
sudo dnf update postgisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider restricting access to the database and monitoring for unusual activity as a temporary measure. Additionally, avoid executing untrusted SQL queries until the vulnerability is patched.
Conclusion
The vulnerability CVE-2026-73515 poses a significant risk to users of PostGIS and its related packages. It is essential to update to the patched version to ensure the security of your systems. Regular monitoring and prompt action can help mitigate potential threats.
See every vulnerability recorded for postgis →
FAQ
CVE-2026-73515 is a security vulnerability in the PostGIS extension for PostgreSQL that could allow attackers to execute unauthorized SQL queries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2026-73515 is 8.1, indicating a high severity level.
If you cannot update immediately, restrict access to your database and monitor for any unusual activity as a temporary workaround.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:65899.json.
Related vulnerabilities
Recent vulnerabilities recorded for postgis.
