Critical Security Update for pg_repack and Related Packages: CVE-2026-103484
Summary
RHSA-2026:85814: Red Hat Security Advisory: postgresql:18 security update. Affects pg_repack versions < 0:1.5.3-1.module+el9.8.0+23739+1c42644c. Fixed in 0:1.5.3-1.module+el9.8.0+23739+1c42644c. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pg_repack is a PostgreSQL extension that allows for the reorganization of tables and indexes to reclaim disk space and improve performance. It is widely used in database management to optimize storage and enhance query performance. However, recent vulnerabilities have been identified that could potentially compromise the integrity and security of systems utilizing this package.
Vulnerability Detail
The vulnerability identified as CVE-2026-103484 affects multiple packages including pg_repack, pgaudit, pgvector, and postgis. It arises from improper handling of certain inputs, which could allow an attacker to execute arbitrary code or cause a denial of service. The severity of this vulnerability is underscored by its CVSS score of 8.8, indicating a high risk to affected systems. If exploited, this vulnerability could lead to unauthorized access to sensitive data or disruption of service, making it critical for users to address it promptly.
How To Fix
Minimum fixed version
0:1.5.3-1.module+el9.8.0+23739+1c42644c
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the affected services or implement network-level controls to limit exposure until the patches are applied. Additionally, monitoring logs for unusual activity may help mitigate potential exploitation.
Conclusion
The vulnerability CVE-2026-103484 poses a significant risk to users of pg_repack and related PostgreSQL packages. It is crucial for users to update their systems to the patched versions to mitigate potential security threats. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2026-103484 is a critical vulnerability affecting several PostgreSQL-related packages, which could allow attackers to execute arbitrary code or cause a denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 8.8, indicating a high level of risk.
If immediate updates are not possible, consider implementing network-level controls and monitoring for unusual activity as a temporary workaround.
More information can be found in the Red Hat Security Advisory and through the CVE database.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.