Critical Security Vulnerability in PostgreSQL: Red Hat Security Advisory RHSA-2026:72361
Summary
RHSA-2026:72361: Red Hat Security Advisory: postgresql security update. Affects postgresql versions < 0:13.23-1.el9_2.5. Fixed in 0:13.23-1.el9_2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its reliability, robustness, and performance. The affected version, 13.23-1.el9_2.5, is part of the Red Hat Enterprise Linux ecosystem, specifically designed for enterprise applications. This vulnerability affects various PostgreSQL packages, including the core database, contrib modules, and server components, making it crucial for users to address it promptly.
Vulnerability Detail
The vulnerability identified in this advisory is associated with multiple CVEs, including CVE-2026-14662 and CVE-2026-14664, among others. These vulnerabilities can lead to unauthorized access, data corruption, or denial of service, significantly impacting the integrity and availability of the database. The vulnerabilities stem from flaws in the handling of certain SQL commands and improper validation of user inputs, which can be exploited by attackers to execute arbitrary code or manipulate database operations.
How To Fix
Minimum fixed version
0:13.23-1.el9_2.5
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the PostgreSQL server by modifying the pg_hba.conf file to limit connections to trusted IP addresses only. This can be done by adding the following line: 'host all all <trusted_ip_address> md5'. Replace <trusted_ip_address> with the actual IP address you wish to allow.
Conclusion
In summary, the critical security vulnerability in PostgreSQL, as outlined in Red Hat Security Advisory RHSA-2026:72361, poses significant risks to users. It is essential to update to the patched version to safeguard your database and maintain its integrity. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for postgresql →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without requiring any signup.
Failure to address this vulnerability may result in unauthorized access, data loss, or service disruptions, compromising the security and reliability of your database.
While PostgreSQL is generally safe for production use, it is crucial to apply the necessary updates to mitigate this vulnerability and ensure the security of your data.
More information can be found in the Red Hat Security Advisory at https://security.access.redhat.com/data/osv/RHSA-2026:72361.json.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
