Critical Security Update for PostgreSQL: Addressing Multiple Vulnerabilities
Summary
RHSA-2026:4475: Red Hat Security Advisory: postgresql security update. Affects postgresql versions < 0:13.23-1.el9_2.1. Fixed in 0:13.23-1.el9_2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, feature robustness, and performance. The affected version of PostgreSQL, 13.23, is part of the Red Hat ecosystem and is widely used in enterprise applications. This vulnerability poses a significant risk to data integrity and security, making it crucial for users to address it promptly.
Vulnerability Detail
The vulnerabilities identified as CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006 affect PostgreSQL versions prior to 13.23-1.el9_2.1. These vulnerabilities could allow attackers to exploit weaknesses in the database, potentially leading to unauthorized access, data corruption, or denial of service. The vulnerabilities stem from improper handling of certain database operations, which can be exploited if left unpatched.
How To Fix
Minimum fixed version
0:13.23-1.el9_2.1
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the PostgreSQL server by configuring firewall rules to limit connections to trusted IP addresses. This can help mitigate the risk until the patch is applied.
Conclusion
The identified vulnerabilities in PostgreSQL pose significant risks to data security and integrity. It is imperative for users to update their installations to the latest patched version to mitigate these risks. Implementing temporary workarounds can provide additional protection until the update is applied.
See every vulnerability recorded for postgresql →
FAQ
The vulnerabilities include CVE-2026-2004, CVE-2026-2005, and CVE-2026-2006, which can lead to unauthorized access and data corruption.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
If immediate updates are not possible, consider implementing firewall rules to restrict access to the database as a temporary workaround.
More information can be found in the Red Hat Security Advisory and the CVE listings for the respective vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
