Critical Security Update for pg_repack: CVE-2026-6473 and Related Vulnerabilities
Summary
RHSA-2026:42555: Red Hat Security Advisory: postgresql:13 security update. Affects pg_repack versions < 0:1.4.6-3.module+el8.5.0+11357+bcc62552. Fixed in 0:1.4.6-3.module+el8.5.0+11357+bcc62552. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pg_repack is an extension for PostgreSQL that allows users to reorganize tables in a database to reclaim space and improve performance. It is widely used in environments where database performance and storage efficiency are critical. However, recent vulnerabilities have been identified that could potentially compromise the security of systems utilizing this package.
Vulnerability Detail
The vulnerabilities, including CVE-2026-6473, CVE-2026-6475, CVE-2026-6477, CVE-2026-6478, and CVE-2026-6637, stem from flaws in the pg_repack package that could allow unauthorized access or manipulation of database contents. These vulnerabilities can lead to severe consequences, including data breaches, loss of data integrity, and unauthorized access to sensitive information. The CVSS score of this vulnerability is 8.8, indicating a high severity level that necessitates immediate attention.
How To Fix
Minimum fixed version
0:1.4.6-3.module+el8.5.0+11357+bcc62552
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, if updating the package is not immediately feasible, consider restricting access to the database and monitoring for any suspicious activity. Implementing strict user permissions can help mitigate the risk until the package is updated.
Conclusion
In summary, the vulnerabilities identified in the pg_repack package pose significant risks to database security. Immediate action is required to update the package to the patched version to mitigate these risks. Regular monitoring and adherence to security best practices are essential to protect sensitive data.
See every vulnerability recorded for pg_repack →
FAQ
The vulnerabilities in pg_repack could allow unauthorized access to database contents, potentially leading to data breaches and integrity issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Immediately update the pg_repack package to the latest patched version and restrict database access until the update is applied.
The CVSS score of this vulnerability is 8.8, indicating a high severity level that requires prompt action.
You can visit Vulert at https://vulert.com, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
