RHSA-2026:99821
Vulnerability from csaf_redhat - Published: 2026-11-12 18:37 - Updated: 2026-11-14 00:29Summary
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
Severity
Important
Notes
Topic: An update for Red Hat Hardened Images RPMs is now available.
Details: This update includes the following RPMs:
libpq:
* libpq-18.7-0.1.hum1 (aarch64, s390x, x86_64)
* libpq-devel-18.7-0.1.hum1 (aarch64, s390x, x86_64)
* libpq-18.7-0.1.hum1.src (src)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in PostgreSQL. Inadequate tracking of typed values allows an authenticated user with permissions to create or alter database objects to trigger a type confusion vulnerability by executing specific data definition commands, such as altering column data types. A threat actor can exploit this issue to execute arbitrary code on the host system with the permissions of the operating system user running the database service.
8.8 (High)
Affected products
Fixed
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in PostgreSQL. An uncontrolled search path issue in extension management allows an authenticated user with database-level CREATE privileges to execute arbitrary code as the database superuser. By altering schemas or specifying crafted schema names during extension installation or modification, an attacker can cause trusted extension scripts to execute arbitrary SQL commands with elevated privileges.
7.2 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated user can supply an arbitrary file path using the sslkeylogfile connection parameter in database features such as dblink or subscription management commands. By forcing the server to append cryptographic key log data to targeted system files, the user can corrupt critical files, resulting in a persistent Denial of Service (DoS).
8.1 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. When handling conflict-resolving insert statements (INSERT ... ON CONFLICT) on auto-updatable views, the database fails to properly enforce view boundary restrictions. An authenticated attacker with insert and update privileges on a view can exploit this vulnerability through repeated queries to bypass filtering conditions, allowing them to read and modify unauthorized rows in the underlying base table.
5.4 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL's pg_basebackup utility. An attacker who has already compromised a database server can supply a crafted backup manifest containing unexpected formatting characters. When the client utility processes this data, it can lead to information disclosure by exposing internal client memory contents.
CWE-134 - Use of Externally-Controlled Format StringAffected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Low
A flaw was found in PostgreSQL. An authenticated database user with privileges to create database objects can trigger a type confusion flaw by defining a SQL-language function with an output parameter of type "any". This vulnerability allows the user to execute arbitrary code with the permissions of the operating system user running the database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can bypass permission checks to invoke restricted type conversion (cast) functions without the necessary execution privileges. By triggering operations such as foreign key evaluations or data formatting functions, a user may execute unauthorized functions and potentially access sensitive information.
CWE-420 - Unprotected Alternate ChannelAffected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Low
A flaw was found in PostgreSQL. An authenticated database user can exploit this vulnerability to execute arbitrary code with the privileges of the operating system user running the database. This issue stems from a use-after-free condition during the coordination of anonymous RECORD type identifiers across parallel worker processes, where one process frees shared memory while another process retains and accesses its address.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated user with database object creation privileges can trigger a type confusion issue during composite-value field assignments by altering composite types between operations. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system account running the database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A use-after-free memory flaw in the PL/Perl (plperl) procedural language extension allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database service. This issue occurs when re-entering the plperl environment and freeing a prepared database query while an outer invocation is actively executing it.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can trigger a buffer over-read in the dict_int extension by supplying a zero-length token. This vulnerability can lead to information disclosure by exposing portions of server memory.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. A type confusion vulnerability in the PL/Perl (Procedural Language/Perl) extension may allow an authenticated database user to achieve arbitrary code execution. By passing an unexpected data reference type into an internal array structure (PostgreSQL::InServer::ARRAY), an attacker can cause the server to misinterpret memory, potentially compromising the underlying database host.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can trigger a use-after-free condition—where the application accesses memory after it has been released—during COPY FROM error reporting by supplying an input row following an ignored data conversion error. This issue allows the user to read portions of server memory, leading to unauthorized information disclosure.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An authenticated database user can execute the DROP OWNED command to improperly remove their role from restrictive Row-Level Security (RLS) policies. By bypassing these access controls, the user can view or modify table rows that were intended to be restricted.
5.4 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can cause automated database rules (AFTER triggers) to process incorrect row data by running a MERGE operation on a partitioned table that inserts records before updating them. This failure to maintain consistent row transition state can result in unintended data modifications and data integrity issues.
5.4 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An untrusted search path vulnerability in the vacuumdb utility allows a database owner to execute arbitrary Structured Query Language (SQL) commands with the privileges of the user running vacuumdb. By defining custom operators that override those used in vacuumdb's internal catalog queries, an attacker can hijack query execution and escalate privileges within the database.
7.2 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An attacker can achieve arbitrary code execution as the operating system user running the pg_restore database restoration utility by providing a specially crafted archive file. Due to improper input validation, processing this malicious archive causes commands to execute directly on the host system rather than executing database queries within the target database.
7.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying specifically structured text search vector (tsvector) data to the tsvector_delete() function, an attacker triggers a heap-based buffer overflow due to improper handling of alignment padding.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can achieve privilege escalation and execute arbitrary SQL commands with the permissions of another session. By defining a custom data type in a temporary schema (pg_temp), an attacker can cause a victim's security-restricted operation to execute malicious code when processing unqualified type names.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A heap-based buffer overflow in the text search ranking function, ts_rank_cd(), allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying a malformed text search vector (tsvector) containing duplicate positions, an attacker can trigger memory corruption, resulting in arbitrary code execution or a denial of service (DoS).
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL's pg_dump utility. An authenticated database user with permission to create objects can trigger a SQL injection vulnerability by defining an inherited column with a child-local constraint whose name requires quoting. When the resulting database dump is restored, this flaw allows arbitrary SQL commands to be executed with the privileges of the restoring user.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with permission to create objects can trigger a use-after-free memory flaw in the PL/Perl procedural language extension through reentrant return_next() calls. This vulnerability allows the user to execute arbitrary code on the host system as the operating system user running the database.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can achieve arbitrary code execution with the privileges of the operating system user running the database due to a use-after-free vulnerability in the PL/Perl procedural language. This issue occurs when the final reference to a Perl array or hash is dropped while PostgreSQL is converting the object, resulting in memory corruption.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can exploit improper string termination during array element assignment to cause server memory disclosure. By modifying the final byte of a fixed-length name value and passing it to internal routines expecting a null-terminated string, an attacker can read sensitive information from server memory.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an unexpected server restart. This issue occurs due to improper locking during startup processing when an authentication timeout occurs while a lock is held during cancel handling.
5.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. A use-after-free vulnerability in the PL/Tcl procedural language extension occurs when evaluating domain CHECK constraints that re-enter the Tcl interpreter. An authenticated database user with privileges to create objects can exploit this flaw to execute arbitrary code as the operating system user running the database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL's reindexdb utility. An authenticated database user with privileges to create objects can execute arbitrary SQL commands with the permissions of the database user running the utility. This issue occurs when crafted index names are improperly sanitized during parallel catalog queries when reindexdb is executed with the --jobs and --index options.
8.0 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated user with permissions to create database objects can exploit uncaught exceptions within the PL/Perl language extension by supplying a crafted Perl object while an existing error is being handled. This issue leads to the reuse of stale memory buffers, potentially resulting in arbitrary code execution or a Denial of Service (DoS).
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can bypass security barrier view protections to infer sensitive values that should remain restricted. By executing queries that apply custom or user-defined functions against internal test values representing protected columns, an attacker can disclose unauthorized data.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An integer wraparound vulnerability in memory context management allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database. By freeing a memory allocation exceeding one gigabyte (1 GB), the system improperly reuses memory blocks due to an offset calculation error, resulting in memory corruption.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A type confusion vulnerability in the statistics import mechanism allows an authenticated user with table maintenance privileges to execute arbitrary code with the permissions of the operating system user running the database service. An attacker can trigger this issue by supplying nested SET DATA TYPE commands during the conversion of imported statistical values.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. When backing up a database using the pg_dump utility with tar-format archives, the generated restore script uses a predictable restriction key. A compromised or malicious database server can exploit this flaw by injecting untrusted data, leading to arbitrary code execution with the operating system privileges of the client account running the restore command.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated user with permission to create database objects can exploit this vulnerability to achieve arbitrary code execution as the operating system user running the database service. The issue occurs during query optimization when a user-defined aggregate function specifies a sort operator (SORTOP) that causes the query planner to treat different data types as identical. This data type confusion allows an attacker to manipulate internal memory and compromise the host system.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability allows an authenticated database user with object creation privileges to execute arbitrary code with the permissions of the operating system user running the database service. The issue stems from a use-after-free flaw (accessing memory after it has been released) during portal setup, which occurs when user-defined code executes during query planning or execution startup and closes the portal currently being prepared.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with permission to create database objects can trigger a buffer over-read during parallel B-tree index scans by defining a function incorrectly marked as parallel safe or stable. This issue causes participating worker processes to generate inconsistent search keys, allowing the attacker to read arbitrary server memory and resulting in sensitive information disclosure.
6.5 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An authenticated database user with permissions to create database objects can trigger a type confusion issue by creating operator commutator or negator links with mismatched result types or inconsistent reciprocal links. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system user running the database server.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with privileges to create objects can execute arbitrary code on the host system as the operating system user running the database service. This vulnerability occurs when the REINDEX CONCURRENTLY operation processes an index expression that executes a DROP INDEX command, resulting in an unsafe operation on a dropped index.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An integer wraparound (an arithmetic calculation exceeding numerical limits) occurs during in-memory tuple-size calculations when handling oversized data. An authenticated database user can exploit this flaw to execute arbitrary code with the privileges of the operating system user running the database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A type confusion vulnerability in materialized set-returning functions allows an authenticated database user to execute arbitrary code on the server with the privileges of the operating system user running the database. By returning rows with differing dynamic record types (such as through the json_populate_recordset() function), the database misinterprets data types in memory, leading to arbitrary code execution.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with object creation privileges can exploit this vulnerability to execute arbitrary code on the host as the operating system user running the database service. By defining row types with dropped attributes in identical positions but differing data widths or alignments, an attacker triggers a type confusion condition within anonymous record types.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A use-after-free vulnerability in trigger functions allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database. By defining a cursor over a transition table within a trigger function, an attacker can access previously freed memory, resulting in memory corruption and full compromise of the database service process.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. Incomplete type-cache invalidation allows an authenticated user with permission to create database objects to trigger type confusion by modifying a composite data type while its cache entry is being populated. A successful exploit enables the attacker to execute arbitrary code on the host system with the operating system privileges of the running database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. Missing authorization checks in logical replication allow a compromised publisher to execute arbitrary code as the operating system user running the database service. An attacker controlling a publishing database can exploit this vulnerability by designating an internal system catalog table as a replication target for a superuser-owned subscription.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with limited privileges can bypass authorization checks when executing the REASSIGN OWNED command. This flaw allows the user to reassign database or object ownership without the required administrative privileges, leading to unauthorized modification of database assets.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in the PostgreSQL dblink extension. A use-after-free vulnerability allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database. This flaw is triggered when custom type conversion logic re-enters the dblink extension and closes an active connection while an outer query is still reading its results.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A type confusion vulnerability in the extended statistics component allows an authenticated database user with object creation permissions to execute arbitrary code as the operating system user running the database. By defining an extended statistics expression with an anonymous record type, an attacker can cause data types to be misinterpreted across database sessions, leading to memory corruption.
8.1 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A heap-based buffer overflow vulnerability in foreign batch insert operations allows a foreign server to execute arbitrary code. This issue occurs when a remote foreign server reports that it inserted more data rows than the local database server supplied, leading to memory corruption.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. A use-after-free memory vulnerability exists during expanded-record domain checks. An authenticated database user with object creation permissions can trigger this issue by performing repeated domain checks over composite data types, leading to the reuse of freed memory. Successful exploitation allows the attacker to execute arbitrary code on the underlying system with the privileges of the operating system user running the database service.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. This vulnerability allows an authenticated user with database object creation privileges to execute arbitrary code with the permissions of the operating system account running the database service. The issue stems from a type confusion condition in the PL/pgSQL (Procedural Language/PostgreSQL) engine during record-field assignments, where a re-entrant domain check alters a record variable's structure while casting a value.
8.8 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user can trigger a use-after-free vulnerability by loading a module while the pg_show_all_settings() function is scanning custom-variable placeholders that the module replaces and frees. Successful exploitation allows the user to read internal memory contents, resulting in unauthorized information disclosure.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
A flaw was found in PostgreSQL. An authenticated user with database-level CREATE privileges can execute arbitrary code as the administrative superuser through a Structured Query Language (SQL) injection vulnerability in extension-script substitutions. By supplying a crafted schema or owner name containing newlines or special characters to an affected extension script, an attacker can manipulate script execution to achieve privilege escalation.
7.2 (High)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Important
A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can bypass Row-Level Security (RLS) policies, leading to unauthorized information disclosure. By executing iterated INSERT ... ON CONFLICT DO UPDATE statements, an attacker can read protected rows that should otherwise be restricted by security policies.
4.3 (Medium)
Affected products
Fixed
7 products, the same list as for
CVE-2026-6460
Threats
Impact
Moderate
References
316 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for Red Hat Hardened Images RPMs is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "This update includes the following RPMs:\n\nlibpq:\n * libpq-18.7-0.1.hum1 (aarch64, s390x, x86_64)\n * libpq-devel-18.7-0.1.hum1 (aarch64, s390x, x86_64)\n * libpq-18.7-0.1.hum1.src (src)",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:99821",
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "external",
"summary": "https://images.redhat.com/",
"url": "https://images.redhat.com/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116330",
"url": "https://access.redhat.com/security/cve/CVE-2026-116330"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116315",
"url": "https://access.redhat.com/security/cve/CVE-2026-116315"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16237",
"url": "https://access.redhat.com/security/cve/CVE-2026-16237"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6460",
"url": "https://access.redhat.com/security/cve/CVE-2026-6460"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116323",
"url": "https://access.redhat.com/security/cve/CVE-2026-116323"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116306",
"url": "https://access.redhat.com/security/cve/CVE-2026-116306"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116312",
"url": "https://access.redhat.com/security/cve/CVE-2026-116312"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116304",
"url": "https://access.redhat.com/security/cve/CVE-2026-116304"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116327",
"url": "https://access.redhat.com/security/cve/CVE-2026-116327"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116321",
"url": "https://access.redhat.com/security/cve/CVE-2026-116321"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-18447",
"url": "https://access.redhat.com/security/cve/CVE-2026-18447"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116333",
"url": "https://access.redhat.com/security/cve/CVE-2026-116333"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120148",
"url": "https://access.redhat.com/security/cve/CVE-2026-120148"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116320",
"url": "https://access.redhat.com/security/cve/CVE-2026-116320"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6467",
"url": "https://access.redhat.com/security/cve/CVE-2026-6467"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120142",
"url": "https://access.redhat.com/security/cve/CVE-2026-120142"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116308",
"url": "https://access.redhat.com/security/cve/CVE-2026-116308"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120153",
"url": "https://access.redhat.com/security/cve/CVE-2026-120153"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116303",
"url": "https://access.redhat.com/security/cve/CVE-2026-116303"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120139",
"url": "https://access.redhat.com/security/cve/CVE-2026-120139"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120146",
"url": "https://access.redhat.com/security/cve/CVE-2026-120146"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116314",
"url": "https://access.redhat.com/security/cve/CVE-2026-116314"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120144",
"url": "https://access.redhat.com/security/cve/CVE-2026-120144"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14661",
"url": "https://access.redhat.com/security/cve/CVE-2026-14661"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116311",
"url": "https://access.redhat.com/security/cve/CVE-2026-116311"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120152",
"url": "https://access.redhat.com/security/cve/CVE-2026-120152"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116317",
"url": "https://access.redhat.com/security/cve/CVE-2026-116317"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116313",
"url": "https://access.redhat.com/security/cve/CVE-2026-116313"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116335",
"url": "https://access.redhat.com/security/cve/CVE-2026-116335"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116316",
"url": "https://access.redhat.com/security/cve/CVE-2026-116316"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116331",
"url": "https://access.redhat.com/security/cve/CVE-2026-116331"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116318",
"url": "https://access.redhat.com/security/cve/CVE-2026-116318"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116336",
"url": "https://access.redhat.com/security/cve/CVE-2026-116336"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116328",
"url": "https://access.redhat.com/security/cve/CVE-2026-116328"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116307",
"url": "https://access.redhat.com/security/cve/CVE-2026-116307"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120147",
"url": "https://access.redhat.com/security/cve/CVE-2026-120147"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116322",
"url": "https://access.redhat.com/security/cve/CVE-2026-116322"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120151",
"url": "https://access.redhat.com/security/cve/CVE-2026-120151"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16240",
"url": "https://access.redhat.com/security/cve/CVE-2026-16240"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120145",
"url": "https://access.redhat.com/security/cve/CVE-2026-120145"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120141",
"url": "https://access.redhat.com/security/cve/CVE-2026-120141"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120154",
"url": "https://access.redhat.com/security/cve/CVE-2026-120154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116329",
"url": "https://access.redhat.com/security/cve/CVE-2026-116329"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116309",
"url": "https://access.redhat.com/security/cve/CVE-2026-116309"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120150",
"url": "https://access.redhat.com/security/cve/CVE-2026-120150"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120149",
"url": "https://access.redhat.com/security/cve/CVE-2026-120149"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116319",
"url": "https://access.redhat.com/security/cve/CVE-2026-116319"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-120143",
"url": "https://access.redhat.com/security/cve/CVE-2026-120143"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116325",
"url": "https://access.redhat.com/security/cve/CVE-2026-116325"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116326",
"url": "https://access.redhat.com/security/cve/CVE-2026-116326"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116332",
"url": "https://access.redhat.com/security/cve/CVE-2026-116332"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-116310",
"url": "https://access.redhat.com/security/cve/CVE-2026-116310"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_99821.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update",
"tracking": {
"current_release_date": "2026-11-14T00:29:38+00:00",
"generator": {
"date": "2026-11-14T00:29:38+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.6"
}
},
"id": "RHSA-2026:99821",
"initial_release_date": "2026-11-12T18:37:59+00:00",
"revision_history": [
{
"date": "2026-11-12T18:37:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-11-12T19:12:27+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-11-14T00:29:38+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Hardened Images",
"product": {
"name": "Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:hummingbird:1"
}
}
}
],
"category": "product_family",
"name": "Red Hat Hardened Images"
},
{
"branches": [
{
"category": "product_version",
"name": "libpq-0:18.7-0.1.hum1@aarch64",
"product": {
"name": "libpq-0:18.7-0.1.hum1@aarch64",
"product_id": "libpq-0:18.7-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq@18.7-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
},
{
"category": "product_version",
"name": "libpq-devel-0:18.7-0.1.hum1@aarch64",
"product": {
"name": "libpq-devel-0:18.7-0.1.hum1@aarch64",
"product_id": "libpq-devel-0:18.7-0.1.hum1@aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq-devel@18.7-0.1.hum1?arch=aarch64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-aarch64-rpms"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libpq-0:18.7-0.1.hum1@s390x",
"product": {
"name": "libpq-0:18.7-0.1.hum1@s390x",
"product_id": "libpq-0:18.7-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq@18.7-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
},
{
"category": "product_version",
"name": "libpq-devel-0:18.7-0.1.hum1@s390x",
"product": {
"name": "libpq-devel-0:18.7-0.1.hum1@s390x",
"product_id": "libpq-devel-0:18.7-0.1.hum1@s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq-devel@18.7-0.1.hum1?arch=s390x\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-s390x-rpms"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "libpq-0:18.7-0.1.hum1@src",
"product": {
"name": "libpq-0:18.7-0.1.hum1@src",
"product_id": "libpq-0:18.7-0.1.hum1@src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq@18.7-0.1.hum1?arch=src\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-source-rpms"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libpq-0:18.7-0.1.hum1@x86_64",
"product": {
"name": "libpq-0:18.7-0.1.hum1@x86_64",
"product_id": "libpq-0:18.7-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq@18.7-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
},
{
"category": "product_version",
"name": "libpq-devel-0:18.7-0.1.hum1@x86_64",
"product": {
"name": "libpq-devel-0:18.7-0.1.hum1@x86_64",
"product_id": "libpq-devel-0:18.7-0.1.hum1@x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libpq-devel@18.7-0.1.hum1?arch=x86_64\u0026distro=hummingbird-20251124\u0026repository_id=public-hummingbird-x86_64-rpms"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-0:18.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64"
},
"product_reference": "libpq-0:18.7-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-0:18.7-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x"
},
"product_reference": "libpq-0:18.7-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-0:18.7-0.1.hum1@src as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src"
},
"product_reference": "libpq-0:18.7-0.1.hum1@src",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-0:18.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64"
},
"product_reference": "libpq-0:18.7-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-devel-0:18.7-0.1.hum1@aarch64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64"
},
"product_reference": "libpq-devel-0:18.7-0.1.hum1@aarch64",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-devel-0:18.7-0.1.hum1@s390x as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x"
},
"product_reference": "libpq-devel-0:18.7-0.1.hum1@s390x",
"relates_to_product_reference": "Red Hat Hardened Images"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libpq-devel-0:18.7-0.1.hum1@x86_64 as a component of Red Hat Hardened Images",
"product_id": "Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
},
"product_reference": "libpq-devel-0:18.7-0.1.hum1@x86_64",
"relates_to_product_reference": "Red Hat Hardened Images"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-6460",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:34:11.188789+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572578"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. Inadequate tracking of typed values allows an authenticated user with permissions to create or alter database objects to trigger a type confusion vulnerability by executing specific data definition commands, such as altering column data types. A threat actor can exploit this issue to execute arbitrary code on the host system with the permissions of the operating system user running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in data definition commands",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an authenticated user with object-creation privileges can execute arbitrary code under the operating system account running the PostgreSQL service. Although this allows full compromise of the database daemon host environment, exploitation requires prior authentication to the database and permissions to execute data definition statements, which precludes unauthenticated remote attacks. In standard Red Hat deployments, database instances should be configured so that untrusted users are not granted table creation or administrative schema alteration privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6460"
},
{
"category": "external",
"summary": "RHBZ#2572578",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572578"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6460",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6460"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6460",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6460"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6460/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6460/"
}
],
"release_date": "2026-11-12T14:15:32.415000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Limit exposure to the PostgreSQL service by restricting network connectivity to trusted administrative hosts and revoking object-creation privileges from untrusted database accounts.\n\n1. Restrict network reachability to trusted IP addresses using firewalld:\n```\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_network\u003e\nfirewall-cmd --reload\n```\n\n2. Revoke table creation privileges from untrusted database accounts within PostgreSQL:\n```\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n```\n\nCaveats: Restricting network access prevents unapproved remote hosts from connecting to the database server. Revoking schema creation privileges may disrupt applications that require dynamic creation of temporary or permanent tables until explicit schema permissions are assigned.\n\nWarning: Reloading the firewall configuration using `firewall-cmd --reload` alters active packet filtering rules immediately and may disrupt existing network sessions.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in data definition commands"
},
{
"cve": "CVE-2026-6467",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-11-12T14:31:36.382128+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572538"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An uncontrolled search path issue in extension management allows an authenticated user with database-level CREATE privileges to execute arbitrary code as the database superuser. By altering schemas or specifying crafted schema names during extension installation or modification, an attacker can cause trusted extension scripts to execute arbitrary SQL commands with elevated privileges.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Privilege escalation via uncontrolled search path in extension management",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact because an authenticated user possessing database creation rights can escalate privileges to the database bootstrap superuser, resulting in complete administrative control over the PostgreSQL instance. While the flaw demands pre-existing database credentials with database-level CREATE permissions, the resulting blast radius encompasses full compromise of database confidentiality, integrity, and availability. In standard Red Hat Enterprise Linux deployments, unprivileged users do not receive database-level CREATE permissions by default, limiting exposure to systems configured for non-superuser extension administration or delegated multi-tenant operations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6467"
},
{
"category": "external",
"summary": "RHBZ#2572538",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572538"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6467",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6467"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6467",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6467"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6467/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6467/"
}
],
"release_date": "2026-11-12T14:15:32.994000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Revoke database-level CREATE privileges from untrusted roles and restrict network access to the PostgreSQL service.\n\nTo prevent non-superusers from creating schemas or installing extensions, revoke the database creation privilege in PostgreSQL:\n\nREVOKE CREATE ON DATABASE \u003cdatabase_name\u003e FROM PUBLIC;\nREVOKE CREATE ON DATABASE \u003cdatabase_name\u003e FROM \u003crole_name\u003e;\n\nAdditionally, limit network exposure by restricting connections in pg_hba.conf to trusted hosts, or enforce firewall rules via firewalld:\n\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --reload\n\nIf modifying pg_hba.conf, apply configuration changes using:\n\nsystemctl reload postgresql\n\nWarning: Reloading the service or applying firewall rules will alter network connectivity and may disconnect clients that are not explicitly permitted. Revoking the CREATE privilege prevents affected accounts from defining new schemas or managing extensions until granted by a superuser.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Privilege escalation via uncontrolled search path in extension management"
},
{
"cve": "CVE-2026-14661",
"cwe": {
"id": "CWE-73",
"name": "External Control of File Name or Path"
},
"discovery_date": "2026-11-12T14:33:25.390938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572565"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated user can supply an arbitrary file path using the sslkeylogfile connection parameter in database features such as dblink or subscription management commands. By forcing the server to append cryptographic key log data to targeted system files, the user can corrupt critical files, resulting in a persistent Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as having an Important severity because authenticated users with access to connection-string-capable database mechanisms can corrupt essential service files, resulting in a persistent and severe denial of service. Under default Red Hat Enterprise Linux deployments, SELinux policy confines the database daemon and prevents file modifications outside of PostgreSQL-managed directories, protecting core operating system components. Nonetheless, invalid TLS key logging data appended to internal database configuration files or data clusters can permanently crash the service and prevent startup, necessitating manual administrative recovery.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14661"
},
{
"category": "external",
"summary": "RHBZ#2572565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572565"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14661",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14661"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14661",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14661"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-14661/",
"url": "https://www.postgresql.org/support/security/CVE-2026-14661/"
}
],
"release_date": "2026-11-12T14:15:30.140000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Persistent Denial of Service via arbitrary file append in sslkeylogfile parameter"
},
{
"cve": "CVE-2026-16237",
"cwe": {
"id": "CWE-639",
"name": "Authorization Bypass Through User-Controlled Key"
},
"discovery_date": "2026-11-12T14:33:56.614648+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572574"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. When handling conflict-resolving insert statements (INSERT ... ON CONFLICT) on auto-updatable views, the database fails to properly enforce view boundary restrictions. An authenticated attacker with insert and update privileges on a view can exploit this vulnerability through repeated queries to bypass filtering conditions, allowing them to read and modify unauthorized rows in the underlying base table.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity rather than Important because exploitation requires an authenticated attacker who already possesses both insert and modification permissions on a targeted view, limiting the blast radius to environments where auto-updatable views are relied upon as security boundaries. In typical Red Hat Enterprise Linux deployments, PostgreSQL views are not automatically configured with partitioned row-level boundaries, and administrative access is needed to grant the necessary write rights. While security_barrier views are bypassed by this defect when conflict handling queries are repeatedly executed, attackers cannot gain broader system access or affect schemas outside their granted database privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16237"
},
{
"category": "external",
"summary": "RHBZ#2572574",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572574"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16237",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16237"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16237",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16237"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-16237/",
"url": "https://www.postgresql.org/support/security/CVE-2026-16237/"
}
],
"release_date": "2026-11-12T14:15:30.710000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Security restriction bypass via INSERT ON CONFLICT on auto-updatable views"
},
{
"cve": "CVE-2026-16240",
"cwe": {
"id": "CWE-134",
"name": "Use of Externally-Controlled Format String"
},
"discovery_date": "2026-11-12T14:31:33.006996+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572537"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL\u0027s pg_basebackup utility. An attacker who has already compromised a database server can supply a crafted backup manifest containing unexpected formatting characters. When the client utility processes this data, it can lead to information disclosure by exposing internal client memory contents.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure in pg_basebackup via crafted backup manifest",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated with a Low severity impact on Red Hat products because successful exploitation requires an adversary to have already gained control over the target database server before interacting with the client utility. The pg_basebackup tool is a short-lived administrative utility invoked on demand, significantly narrowing the window of exposure compared to continuously running services. Furthermore, memory contents are not automatically exfiltrated across the network during execution, and arbitrary memory write operations are precluded by the underlying formatting routine.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16240"
},
{
"category": "external",
"summary": "RHBZ#2572537",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572537"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16240",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16240"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16240",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16240"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-16240/",
"url": "https://www.postgresql.org/support/security/CVE-2026-16240/"
}
],
"release_date": "2026-11-12T14:15:31.280000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "postgresql: postgresql: Information disclosure in pg_basebackup via crafted backup manifest"
},
{
"cve": "CVE-2026-18447",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:31:15.502686+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572532"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with privileges to create database objects can trigger a type confusion flaw by defining a SQL-language function with an output parameter of type \"any\". This vulnerability allows the user to execute arbitrary code with the permissions of the operating system user running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an authenticated user with schema object creation privileges can escape the database engine and execute arbitrary system commands under the postgres host account. Although this issue allows compromise of the database host, exploitation requires valid database credentials and authorization to define custom functions, preventing unauthenticated remote attackers from triggering it directly. In standard Red Hat Enterprise Linux environments, untrusted database accounts are typically restricted from defining schema objects, limiting the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-18447"
},
{
"category": "external",
"summary": "RHBZ#2572532",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572532"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-18447",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-18447"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-18447",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-18447"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-18447/",
"url": "https://www.postgresql.org/support/security/CVE-2026-18447/"
}
],
"release_date": "2026-11-12T14:15:31.850000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "1. Revoke CREATE privileges on public and user schemas from untrusted database roles to prevent unauthorized function creation:\n\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nREVOKE CREATE ON SCHEMA \u003cschema_name\u003e FROM \u003crole_name\u003e;\n\n2. Restrict network access to the PostgreSQL service to trusted management networks or hosts using firewalld:\n\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003ctrusted_ip_or_subnet\u003e\" service name=\"postgresql\" accept\u0027\nfirewall-cmd --reload\n\n3. Restrict database client access in /var/lib/pgsql/data/pg_hba.conf to trusted IP addresses only, then reload the database configuration:\n\nsystemctl reload postgresql\n\nCaveats:\nRevoking schema creation privileges prevents affected database users from creating or altering functions, tables, or other objects, which may disrupt applications that rely on dynamic object definitions. Restricting network access or filtering client subnets prevents connections from unlisted hosts.\n\nWarning:\nApplying firewall changes or configuration changes requires reloading the firewall (`firewall-cmd --reload`) or the PostgreSQL service (`systemctl reload postgresql`), which may briefly disrupt active network connections or client sessions.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in SQL-language functions"
},
{
"cve": "CVE-2026-116303",
"cwe": {
"id": "CWE-420",
"name": "Unprotected Alternate Channel"
},
"discovery_date": "2026-11-12T14:32:02.138623+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572544"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can bypass permission checks to invoke restricted type conversion (cast) functions without the necessary execution privileges. By triggering operations such as foreign key evaluations or data formatting functions, a user may execute unauthorized functions and potentially access sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Unauthorized execution of restricted cast functions via type conversion operations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having a Low impact because exploitation requires an authenticated database user and depends on the presence of custom cast functions that both restrict execute permissions and expose sensitive data. In standard Red Hat Enterprise Linux PostgreSQL deployments, cast functions are not configured with restrictive execute permissions nor do they handle confidential logic by default. Consequently, typical production environments have virtually no practical exposure to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116303"
},
{
"category": "external",
"summary": "RHBZ#2572544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572544"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116303",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116303"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116303",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116303"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116303/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116303/"
}
],
"release_date": "2026-11-12T14:15:01.762000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "postgresql: PostgreSQL: Unauthorized execution of restricted cast functions via type conversion operations"
},
{
"cve": "CVE-2026-116304",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:34:03.396285+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572576"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can exploit this vulnerability to execute arbitrary code with the privileges of the operating system user running the database. This issue stems from a use-after-free condition during the coordination of anonymous RECORD type identifiers across parallel worker processes, where one process frees shared memory while another process retains and accesses its address.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in parallel worker coordination",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an authenticated database user can gain arbitrary code execution as the postgres system user, escalating beyond database permission controls without requiring administrative privileges. In standard Red Hat Enterprise Linux environments, PostgreSQL enables parallel query execution by default. A memory management issue in parallel worker communication allows an attacker who can run queries to corrupt shared worker state, compromising the confidentiality, integrity, and availability of the database server.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116304"
},
{
"category": "external",
"summary": "RHBZ#2572576",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572576"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116304",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116304"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116304",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116304"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116304/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116304/"
}
],
"release_date": "2026-11-12T14:15:02.654000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in parallel worker coordination"
},
{
"cve": "CVE-2026-116306",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:31:02.082140+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572528"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated user with database object creation privileges can trigger a type confusion issue during composite-value field assignments by altering composite types between operations. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system account running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via composite-value field assignment type confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as an Important severity issue because authenticated clients granted schema modification rights can escalate access to execute arbitrary commands under the operating system account managing PostgreSQL, resulting in a full compromise of database integrity and confidentiality. In standard Red Hat Enterprise Linux deployments, the database daemon operates under a dedicated, unprivileged system user (`postgres`), which confines the blast radius to database files and local service assets rather than full root access. Triggering the flaw requires the ability to construct and manipulate composite types within an active session, preventing unauthenticated external actors or read-only accounts from exploiting the issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116306"
},
{
"category": "external",
"summary": "RHBZ#2572528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116306",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116306"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116306",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116306"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116306/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116306/"
}
],
"release_date": "2026-11-12T14:15:03.245000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network access to the PostgreSQL service to trusted hosts and revoke schema creation permissions from untrusted database accounts.\n\n1. Restrict PostgreSQL network exposure using firewalld to only authorized subnets:\n```\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --permanent --zone=trusted --add-service=postgresql\nfirewall-cmd --reload\n```\n\n2. Restrict object creation privileges within the database:\n```\nREVOKE CREATE ON SCHEMA \u003cschema_name\u003e FROM \u003cusername\u003e;\n```\n\nCaveats:\nRestricting network connectivity mitigates untrusted external exposure but does not prevent exploitation from authorized systems or accounts. Revoking schema creation privileges may break application workflows that require creating custom or temporary data types.\n\nWarning: Executing `firewall-cmd --reload` modifies active firewall rules and may temporarily interrupt active database connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via composite-value field assignment type confusion"
},
{
"cve": "CVE-2026-116307",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:33:07.370819+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572560"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A use-after-free memory flaw in the PL/Perl (plperl) procedural language extension allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database service. This issue occurs when re-entering the plperl environment and freeing a prepared database query while an outer invocation is actively executing it.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in plperl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security rates this vulnerability as Important because authenticated accounts permitted to define custom database objects can execute shell commands under the PostgreSQL service account. The impact does not reach Critical severity because exploitation requires existing database access along with specific object creation permissions, and the PL/Perl language extension is not enabled in standard deployments by default. Environments remain unaffected unless administrators explicitly install and activate PL/Perl and grant object-definition rights to untrusted users.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116307"
},
{
"category": "external",
"summary": "RHBZ#2572560",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572560"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116307",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116307"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116307",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116307"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116307/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116307/"
}
],
"release_date": "2026-11-12T14:15:03.906000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, disable the PL/Perl procedural language extension or remove its subpackage if PL/Perl functions are not required:\n\n1. Drop the PL/Perl extension from affected databases:\n```sql\nDROP EXTENSION IF EXISTS plperl CASCADE;\nDROP EXTENSION IF EXISTS plperlu CASCADE;\n```\n\n2. Alternatively, revoke language usage privileges from untrusted roles:\n```sql\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\n```\n\n3. If PL/Perl is entirely unused across the host, uninstall the optional subpackage:\n```sh\n# dnf remove postgresql-plperl\n```\n\nCaveats:\n- Dropping the extension or removing the subpackage will cause any database queries or stored procedures relying on PL/Perl to fail.\n- Using CASCADE will recursively drop all database objects (such as functions and triggers) that depend on PL/Perl.\n- Warning: Modifying system packages or stopping the database service for maintenance may require a service reload or restart (`systemctl restart postgresql`), which will disconnect active client sessions and cause temporary database unavailability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in plperl"
},
{
"cve": "CVE-2026-116308",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-11-12T14:31:40.275621+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572539"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can trigger a buffer over-read in the dict_int extension by supplying a zero-length token. This vulnerability can lead to information disclosure by exposing portions of server memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure via zero-length token in dict_int",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because exploitation requires an authenticated database connection and the non-default dict_int extension to be installed in the target database. Under standard Red Hat enterprise deployments, this dictionary extension is not enabled by default, significantly limiting the exposure of typical installations. When the extension is present, an authenticated attacker can read adjacent server memory contents, but cannot modify database records or achieve arbitrary code execution.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116308"
},
{
"category": "external",
"summary": "RHBZ#2572539",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572539"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116308"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116308",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116308"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116308/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116308/"
}
],
"release_date": "2026-11-12T14:15:04.565000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Remove the optional dict_int extension from databases where it is not strictly required, or restrict database access to prevent untrusted users from querying dictionaries that rely on this module.\n\nTo remove the extension from a specific database, execute the following SQL command as a superuser or database owner:\n\nDROP EXTENSION IF EXISTS dict_int CASCADE;\n\nCaveats: Dropping this extension removes any dependent full-text search configurations and will cause queries relying on dict_int to fail. Verify whether application schemas utilize this dictionary template prior to removal.\n\nService impact: Executing this command takes effect immediately within the database; restarting or reloading the PostgreSQL service is not required.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Information disclosure via zero-length token in dict_int"
},
{
"cve": "CVE-2026-116309",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:32:25.965683+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572550"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A type confusion vulnerability in the PL/Perl (Procedural Language/Perl) extension may allow an authenticated database user to achieve arbitrary code execution. By passing an unexpected data reference type into an internal array structure (PostgreSQL::InServer::ARRAY), an attacker can cause the server to misinterpret memory, potentially compromising the underlying database host.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because an authenticated database user with permissions to create functions can trigger code execution in the context of the PostgreSQL server process. In standard Red Hat deployments, the PL/Perl procedural language extension is not enabled by default and requires manual installation of the optional postgresql-plperl package. Databases where PL/Perl is not enabled or where untrusted users are not granted function creation privileges are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116309"
},
{
"category": "external",
"summary": "RHBZ#2572550",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572550"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116309",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116309"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116309",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116309"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116309/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116309/"
}
],
"release_date": "2026-11-12T14:15:05.119000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "If PL/Perl is not required, remove the extension from affected databases or uninstall the optional package. Alternatively, restrict language access so that unprivileged users cannot create PL/Perl functions.\n\nTo remove the PL/Perl extension from a database:\n```sql\nDROP EXTENSION IF EXISTS plperl CASCADE;\n```\n\nTo revoke access to the language from general users while retaining it for administrators:\n```sql\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\n```\n\nTo remove the PL/Perl package from the operating system:\n```bash\ndnf remove postgresql-plperl\n```\n\nCaveats: Dropping the extension or uninstalling the package will prevent any existing PL/Perl functions from executing, which may disrupt applications that depend on them. Modifying database extensions takes effect immediately for connected sessions and does not require a service restart.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in PL/Perl"
},
{
"cve": "CVE-2026-116310",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:31:21.981429+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572534"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can trigger a use-after-free condition\u2014where the application accesses memory after it has been released\u2014during COPY FROM error reporting by supplying an input row following an ignored data conversion error. This issue allows the user to read portions of server memory, leading to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure via use-after-free in COPY FROM error reporting",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Moderate impact because exploitation is constrained to reading uninitialized or previously freed server memory and requires an authenticated database user with permissions to execute data import commands. While an attacker cannot modify database records or disrupt service availability directly, the leaked memory contents may disclose sensitive environment or query data. Standard enterprise deployments running versions prior to PostgreSQL 17 do not contain the affected error-handling logic and remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116310"
},
{
"category": "external",
"summary": "RHBZ#2572534",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572534"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116310",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116310"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116310",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116310"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116310/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116310/"
}
],
"release_date": "2026-11-12T14:15:05.798000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Information disclosure via use-after-free in COPY FROM error reporting"
},
{
"cve": "CVE-2026-116311",
"cwe": {
"id": "CWE-283",
"name": "Unverified Ownership"
},
"discovery_date": "2026-11-12T14:34:14.768865+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572579"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can execute the DROP OWNED command to improperly remove their role from restrictive Row-Level Security (RLS) policies. By bypassing these access controls, the user can view or modify table rows that were intended to be restricted.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: row-level security bypass via DROP OWNED",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as a Moderate impact issue for Red Hat products because successful exploitation requires an authenticated database user with existing connection privileges and specifically targets environments enforcing restrictive row-level security (RLS) policies. While an authenticated role can circumvent these restrictive rules to access or alter protected table rows, the flaw does not grant database superuser privileges or compromise the underlying host system. Typical PostgreSQL deployments that do not rely on restrictive row-level security for multi-tenant data separation are not exposed to this risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116311"
},
{
"category": "external",
"summary": "RHBZ#2572579",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572579"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116311",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116311"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116311",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116311"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116311/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116311/"
}
],
"release_date": "2026-11-12T14:15:06.390000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: row-level security bypass via DROP OWNED"
},
{
"cve": "CVE-2026-116312",
"cwe": {
"id": "CWE-628",
"name": "Function Call with Incorrectly Specified Arguments"
},
"discovery_date": "2026-11-12T14:34:07.506069+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572577"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can cause automated database rules (AFTER triggers) to process incorrect row data by running a MERGE operation on a partitioned table that inserts records before updating them. This failure to maintain consistent row transition state can result in unintended data modifications and data integrity issues.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate impact because exploitation requires an authenticated database user with explicit permissions to modify partitioned tables with AFTER triggers, restricting the blast radius to data integrity anomalies rather than system compromise or privilege escalation. In standard Red Hat deployments, PostgreSQL enforces role-based access control, preventing unprivileged or untrusted users from executing modification queries against restricted tables. Although an authorized user can cause trigger handlers to evaluate improper row transition data during combined insertion and modification actions, the flaw does not facilitate broader host access or credential exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116312"
},
{
"category": "external",
"summary": "RHBZ#2572577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572577"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116312",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116312"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116312",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116312"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116312/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116312/"
}
],
"release_date": "2026-11-12T14:15:06.946000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Incorrect trigger row processing via partitioned table MERGE"
},
{
"cve": "CVE-2026-116313",
"cwe": {
"id": "CWE-426",
"name": "Untrusted Search Path"
},
"discovery_date": "2026-11-12T14:31:58.380722+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572543"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An untrusted search path vulnerability in the vacuumdb utility allows a database owner to execute arbitrary Structured Query Language (SQL) commands with the privileges of the user running vacuumdb. By defining custom operators that override those used in vacuumdb\u0027s internal catalog queries, an attacker can hijack query execution and escalate privileges within the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Privilege escalation via untrusted search path in vacuumdb",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because it allows a malicious database owner to achieve complete privilege escalation by executing arbitrary commands with the administrative privileges of the account running maintenance utilities. The risk arises during maintenance routines where untrusted user-defined operators can hijack internal catalog queries. Red Hat enterprise deployments are generally not exposed under default installations as supported platforms ship major versions of PostgreSQL that predate the introduction of the vulnerable catalog query behavior.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116313"
},
{
"category": "external",
"summary": "RHBZ#2572543",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572543"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116313",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116313"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116313",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116313"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116313/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116313/"
}
],
"release_date": "2026-11-12T14:15:07.627000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Privilege escalation via untrusted search path in vacuumdb"
},
{
"cve": "CVE-2026-116314",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command"
},
"discovery_date": "2026-11-12T14:33:11.647744+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572561"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An attacker can achieve arbitrary code execution as the operating system user running the pg_restore database restoration utility by providing a specially crafted archive file. Due to improper input validation, processing this malicious archive causes commands to execute directly on the host system rather than executing database queries within the target database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via crafted archive in pg_restore",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an attacker can achieve arbitrary operating system command execution with the privileges of the user running pg_restore. Exploitation requires user interaction to process a maliciously crafted archive file. While pg_restore is a client utility invoked manually or via administrative scripts, restoring an unverified archive directly compromises the host environment under the executing account rather than being confined to SQL operations on the target database.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116314"
},
{
"category": "external",
"summary": "RHBZ#2572561",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572561"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116314",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116314"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116314",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116314"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116314/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116314/"
}
],
"release_date": "2026-11-12T14:15:08.184000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Do not process or restore archive files from untrusted or unverified sources using pg_restore. If processing an untrusted archive is unavoidable, execute pg_restore within an isolated, sandboxed environment, such as a disposable container or dedicated virtual machine, using an unprivileged user account.\n\nCaveat: Sandboxing restricts exposure on the host operating system, but does not prevent crafted archives from executing arbitrary SQL commands against the destination database during restoration.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via crafted archive in pg_restore"
},
{
"cve": "CVE-2026-116315",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-12T14:31:29.020718+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572536"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying specifically structured text search vector (tsvector) data to the tsvector_delete() function, an attacker triggers a heap-based buffer overflow due to improper handling of alignment padding.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in tsvector_delete()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an Important severity because an authenticated user can trigger a heap buffer overflow to execute arbitrary code with the permissions of the postgres service account, potentially compromising the host. While the impact on system integrity, confidentiality, and availability is high, exploitation requires valid database credentials and access to execute SQL functions, which prevents unauthenticated remote execution. In standard Red Hat Enterprise Linux deployments, exposure is further constrained by default SELinux policies that confine the PostgreSQL daemon and restrict access to broader system resources.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116315"
},
{
"category": "external",
"summary": "RHBZ#2572536",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572536"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116315",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116315"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116315",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116315"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116315/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116315/"
}
],
"release_date": "2026-11-12T14:15:08.773000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network access to PostgreSQL to trusted hosts and clients only, limiting exposure to untrusted database users.\n\n1. Restrict external network reachability to the PostgreSQL service using firewalld:\n# firewall-cmd --permanent --remove-service=postgresql\n# firewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_OR_SUBNET\u003e\n# firewall-cmd --reload\n\n2. Configure /var/lib/pgsql/data/pg_hba.conf to only permit connections from authorized client addresses and trusted database roles, then reload the configuration:\n# systemctl reload postgresql\n\nWarning: Reloading firewall rules or the PostgreSQL service may temporarily interrupt active network connections. These operational controls reduce exposure by limiting network access to trusted clients, but they do not eliminate risk from authenticated users permitted to execute SQL queries.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in tsvector_delete()"
},
{
"cve": "CVE-2026-116316",
"cwe": {
"id": "CWE-427",
"name": "Uncontrolled Search Path Element"
},
"discovery_date": "2026-11-12T14:33:35.563221+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572568"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can achieve privilege escalation and execute arbitrary SQL commands with the permissions of another session. By defining a custom data type in a temporary schema (pg_temp), an attacker can cause a victim\u0027s security-restricted operation to execute malicious code when processing unqualified type names.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Privilege escalation via unqualified type resolution in temporary schema",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as having an Important impact because it allows an authenticated database user to gain elevated privileges and execute arbitrary SQL commands in the context of another session. In multi-tenant environments where multiple users connect to the same PostgreSQL instance, an attacker can create custom types in the temporary schema to hijack queries that omit schema qualification during security-restricted operations. While standard background maintenance tasks such as autovacuum do not execute queries with unqualified type casts and are unaffected, environments that allow untrusted users to connect and execute arbitrary database operations remain exposed.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116316"
},
{
"category": "external",
"summary": "RHBZ#2572568",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572568"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116316",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116316"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116316/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116316/"
}
],
"release_date": "2026-11-12T14:15:09.406000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Privilege escalation via unqualified type resolution in temporary schema"
},
{
"cve": "CVE-2026-116317",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-12T14:33:53.268148+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572573"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A heap-based buffer overflow in the text search ranking function, ts_rank_cd(), allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database service. By supplying a malformed text search vector (tsvector) containing duplicate positions, an attacker can trigger memory corruption, resulting in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in ts_rank_cd()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity rather than Critical because exploitation requires an attacker to be authenticated as a database user with rights to execute queries against the PostgreSQL instance. While default Red Hat Enterprise Linux deployments enforce authentication boundaries and utilize local peer authentication or network restrictions, an authenticated user can leverage a malformed tsvector to execute code within the context of the unprivileged postgres system account. The blast radius is limited by process isolation and SELinux confinement, preventing immediate direct administrative host takeover.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116317"
},
{
"category": "external",
"summary": "RHBZ#2572573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572573"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116317",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116317"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116317/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116317/"
}
],
"release_date": "2026-11-12T14:15:09.968000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network access to the PostgreSQL service to trusted hosts and revoke execute permissions on the vulnerable ranking functions from untrusted database users:\n\n1. Limit incoming network connections to trusted management hosts using firewalld:\n# firewall-cmd --permanent --remove-service=postgresql\n# firewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_network\u003e\n# firewall-cmd --reload\n\n2. Revoke execute permissions on ts_rank_cd functions from the PUBLIC role in affected databases:\nREVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(tsvector, tsquery, integer) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery) FROM PUBLIC;\nREVOKE EXECUTE ON FUNCTION pg_catalog.ts_rank_cd(float4[], tsvector, tsquery, integer) FROM PUBLIC;\n\nCaveats:\nRevoking permissions on ts_rank_cd causes applications utilizing text search ranking via Cover Density to fail with permission denied errors. Applying firewall restrictions blocks external connections not originating from explicitly authorized sources.\n\nWarning:\nReloading firewall configurations via firewall-cmd may interrupt active client network connections. If modifying pg_hba.conf to enforce access restrictions, reloading the database service (systemctl reload postgresql) is required and may temporarily affect client connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via heap-based buffer overflow in ts_rank_cd()"
},
{
"cve": "CVE-2026-116318",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"discovery_date": "2026-11-12T14:33:32.054494+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572567"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL\u0027s pg_dump utility. An authenticated database user with permission to create objects can trigger a SQL injection vulnerability by defining an inherited column with a child-local constraint whose name requires quoting. When the resulting database dump is restored, this flaw allows arbitrary SQL commands to be executed with the privileges of the restoring user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary SQL execution via improper constraint quoting in pg_dump",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important due to the potential for privilege escalation, as an authenticated user with object creation permissions can execute arbitrary SQL commands with the elevated privileges of the administrator restoring the database dump. Although exploitation requires access to create schema objects, the resulting impact allows full administrative compromise of the target database during restoration workflows. Standard Red Hat Enterprise Linux releases package earlier major versions of PostgreSQL that do not contain the affected feature logic and are therefore unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116318"
},
{
"category": "external",
"summary": "RHBZ#2572567",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572567"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116318",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116318"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116318",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116318"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116318/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116318/"
}
],
"release_date": "2026-11-12T14:15:10.532000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary SQL execution via improper constraint quoting in pg_dump"
},
{
"cve": "CVE-2026-116319",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:32:05.818134+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572545"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with permission to create objects can trigger a use-after-free memory flaw in the PL/Perl procedural language extension through reentrant return_next() calls. This vulnerability allows the user to execute arbitrary code on the host system as the operating system user running the database.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in plperl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having Important impact because an authenticated database user with permissions to define functions or objects can exploit a memory corruption flaw to achieve arbitrary code execution in the context of the postgres system user. While successful exploitation grants system-level access under the PostgreSQL process account, the PL/Perl procedural language extension is not enabled by default in standard Red Hat deployments. Consequently, systems that do not explicitly install and enable PL/Perl or that restrict object creation privileges to trusted administrators are not exposed to this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116319"
},
{
"category": "external",
"summary": "RHBZ#2572545",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572545"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116319",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116319"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116319",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116319"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116319/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116319/"
}
],
"release_date": "2026-11-12T14:15:11.112000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Remove the optional PL/Perl package if it is not required by your applications:\n\n# dnf remove postgresql-plperl\n\nAlternatively, drop the PL/Perl extension from affected databases:\n\nDROP EXTENSION IF EXISTS plperl CASCADE;\nDROP EXTENSION IF EXISTS plperlu CASCADE;\n\nIf the extension is required, restrict execution privileges by revoking usage on the language from untrusted database roles:\n\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\n\nCaveats: Dropping the extension or removing the package will break existing stored procedures and database applications that depend on PL/Perl. Revoking USAGE permissions prevents unprivileged users from executing PL/Perl functions.\n\nWarning: Restarting or reloading the PostgreSQL service (e.g., `systemctl restart postgresql`) may be necessary to terminate existing database sessions and apply changes fully, which will temporarily interrupt active client connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in plperl"
},
{
"cve": "CVE-2026-116320",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:33:39.304568+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572569"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can achieve arbitrary code execution with the privileges of the operating system user running the database due to a use-after-free vulnerability in the PL/Perl procedural language. This issue occurs when the final reference to a Perl array or hash is dropped while PostgreSQL is converting the object, resulting in memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Perl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity rather than Critical because exploitation requires valid database authentication and the capability to create or execute PL/Perl procedures, though successful exploitation enables arbitrary code execution as the database server process owner. In default Red Hat Enterprise Linux installations, the PL/Perl procedural language is packaged separately and is not enabled by default. Consequently, environments are only exposed if this optional extension has been explicitly installed and untrusted users have permission to define or run PL/Perl routines.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116320"
},
{
"category": "external",
"summary": "RHBZ#2572569",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572569"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116320",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116320"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116320",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116320"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116320/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116320/"
}
],
"release_date": "2026-11-12T14:15:11.698000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Remove the optional PL/Perl package if procedural Perl functions are not required, or restrict language usage permissions to trusted administrators only.\n\nTo remove the optional package:\n# dnf remove postgresql-plperl\n\nAlternatively, revoke usage of the PL/Perl languages from untrusted database users:\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\nREVOKE USAGE ON LANGUAGE plperlu FROM PUBLIC;\n\nCaveats: Removing the package or revoking language permissions will cause stored procedures and application queries dependent on PL/Perl to fail.\n\nWarning: Existing active database sessions that have already loaded the plperl shared object must be terminated, or the PostgreSQL service restarted, for the removal to take effect across all sessions.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Perl"
},
{
"cve": "CVE-2026-116321",
"cwe": {
"id": "CWE-170",
"name": "Improper Null Termination"
},
"discovery_date": "2026-11-12T14:32:09.464882+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572546"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can exploit improper string termination during array element assignment to cause server memory disclosure. By modifying the final byte of a fixed-length name value and passing it to internal routines expecting a null-terminated string, an attacker can read sensitive information from server memory.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: server memory disclosure via improper null termination in array element assignment",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because exploitation is restricted to authenticated database sessions and only impacts confidentiality through information disclosure, without enabling data modification or denial of service. Under standard Red Hat Enterprise Linux configurations, PostgreSQL services are accessible solely to authorized clients who possess valid database credentials. An attacker authenticated to the database can craft queries manipulating array structures with fixed-length identifier values to read adjacent server memory. Because execution requires valid login credentials and cannot compromise system integrity or execute arbitrary code, the blast radius remains limited to sensitive memory contents.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116321"
},
{
"category": "external",
"summary": "RHBZ#2572546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572546"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116321"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116321/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116321/"
}
],
"release_date": "2026-11-12T14:15:12.297000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: server memory disclosure via improper null termination in array element assignment"
},
{
"cve": "CVE-2026-116322",
"cwe": {
"id": "CWE-413",
"name": "Improper Resource Locking"
},
"discovery_date": "2026-11-12T14:32:59.737196+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572558"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An unauthenticated remote attacker can cause a Denial of Service (DoS) by triggering an unexpected server restart. This issue occurs due to improper locking during startup processing when an authentication timeout occurs while a lock is held during cancel handling.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Denial of Service via improper locking during startup processing",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because an unauthenticated remote attacker can trigger an unexpected database service restart, resulting in a temporary denial of service without compromising data integrity or confidentiality. Successful exploitation requires specific timing to force a timeout during early connection processing, limiting the blast radius solely to service availability. In standard Red Hat enterprise environments, database instances are typically isolated from direct exposure to untrusted public networks, further reducing operational risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116322"
},
{
"category": "external",
"summary": "RHBZ#2572558",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572558"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116322",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116322"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116322",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116322"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116322/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116322/"
}
],
"release_date": "2026-11-12T14:15:12.887000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network exposure by limiting access to the PostgreSQL service to trusted hosts and subnets only, or configure the daemon to listen solely on localhost if remote connections are not required.\n\n1. Restrict inbound network traffic using firewalld:\n```\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_OR_CIDR\u003e\nfirewall-cmd --reload\n```\n\n2. Alternatively, configure PostgreSQL to listen only on localhost in postgresql.conf:\n```\nlisten_addresses = \u0027localhost\u0027\n```\nApply the configuration changes by restarting the service:\n```\nsystemctl restart postgresql\n```\n\nWarning: Restarting or reloading the PostgreSQL service will disrupt active client connections. Restricting firewall rules or listening interfaces will prevent connections from non-allowlisted network clients, potentially impacting dependent applications if trusted endpoints are not configured correctly.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Denial of Service via improper locking during startup processing"
},
{
"cve": "CVE-2026-116323",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:31:05.546411+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572529"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A use-after-free vulnerability in the PL/Tcl procedural language extension occurs when evaluating domain CHECK constraints that re-enter the Tcl interpreter. An authenticated database user with privileges to create objects can exploit this flaw to execute arbitrary code as the operating system user running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Tcl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an authenticated user with permission to create database objects can achieve arbitrary code execution under the postgres operating system account. In standard Red Hat Enterprise Linux deployments, the PL/Tcl procedural language is neither installed nor enabled by default, significantly limiting exposure on typical systems. Risk is primarily confined to environments where the optional PL/Tcl subpackage is explicitly installed and untrusted users have been granted object creation privileges.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116323"
},
{
"category": "external",
"summary": "RHBZ#2572529",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572529"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116323",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116323"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116323",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116323"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116323/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116323/"
}
],
"release_date": "2026-11-12T14:15:13.913000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "If PL/Tcl is not required, remove the optional procedural language package or drop the extension from affected databases. Alternatively, restrict object creation permissions for untrusted database accounts.\n\n1. To remove the optional PL/Tcl package:\n# dnf remove postgresql-pltcl\n\n2. To remove the extension from a specific database, execute the following SQL commands as a database administrator:\nDROP EXTENSION IF EXISTS pltcl CASCADE;\nDROP EXTENSION IF EXISTS pltclu CASCADE;\n\n3. To prevent untrusted accounts from creating custom domains or objects, revoke schema creation privileges:\nREVOKE CREATE ON SCHEMA \u003cschema_name\u003e FROM \u003cusername\u003e;\n\nCaveats:\nDropping the extension with CASCADE removes all dependent database functions, triggers, and objects implemented in PL/Tcl, which can impair application functionality. If package removal or administrative actions require reloading or restarting the PostgreSQL service (systemctl restart postgresql), active client connections will be terminated.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in PL/Tcl"
},
{
"cve": "CVE-2026-116325",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"discovery_date": "2026-11-12T14:31:50.527672+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572541"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL\u0027s reindexdb utility. An authenticated database user with privileges to create objects can execute arbitrary SQL commands with the permissions of the database user running the utility. This issue occurs when crafted index names are improperly sanitized during parallel catalog queries when reindexdb is executed with the --jobs and --index options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary SQL execution in reindexdb via crafted index name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important impact because an authenticated user with object creation privileges can escalate permissions to execute arbitrary SQL commands under the administrative identity running maintenance tasks. Exploitation requires an administrator to run the reindexdb utility specifying both parallel worker jobs and individual index targets against a database containing malicious index names. PostgreSQL deployments on versions prior to 17 do not include parallel catalog query logic in this utility and are not affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116325"
},
{
"category": "external",
"summary": "RHBZ#2572541",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572541"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116325",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116325"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116325",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116325"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116325/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116325/"
}
],
"release_date": "2026-11-12T14:15:14.469000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Avoid combining parallel execution with index targeting when running the reindexdb utility, or invoke reindexing operations directly via SQL.\n\n1. Execute reindexdb sequentially without the parallel worker flag (`-j` / `--jobs`):\n```\nreindexdb -d \u003cdatabase_name\u003e --index \u003cindex_name\u003e\n```\n\n2. Alternatively, perform the reindex operation directly through a psql session:\n```\nREINDEX INDEX \u003cindex_name\u003e;\n```\n\nCaveat: Performing index maintenance sequentially instead of concurrently across multiple worker jobs may prolong maintenance tasks on large databases.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary SQL execution in reindexdb via crafted index name"
},
{
"cve": "CVE-2026-116326",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:31:46.556071+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572540"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated user with permissions to create database objects can exploit uncaught exceptions within the PL/Perl language extension by supplying a crafted Perl object while an existing error is being handled. This issue leads to the reuse of stale memory buffers, potentially resulting in arbitrary code execution or a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via uncaught exceptions in PL/Perl",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated database user with privileges to execute or define PL/Perl functions could achieve arbitrary code execution within the context of the PostgreSQL backend process. However, the PL/Perl procedural language is an optional component that is not enabled by default on standard Red Hat Enterprise Linux PostgreSQL deployments. Environments that do not install the optional plperl subpackage or grant untrusted users access to PL/Perl are not exposed to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116326"
},
{
"category": "external",
"summary": "RHBZ#2572540",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572540"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116326",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116326"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116326",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116326"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116326/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116326/"
}
],
"release_date": "2026-11-12T14:15:15.067000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Disable or restrict access to the PL/Perl extension in affected databases, or remove the optional PL/Perl package if not required.\n\n1. Restrict PL/Perl language usage from untrusted database roles:\n```sql\nREVOKE USAGE ON LANGUAGE plperl FROM PUBLIC;\nREVOKE USAGE ON LANGUAGE plperlu FROM PUBLIC;\n```\n\n2. If PL/Perl is not required, drop the extension from affected databases:\n```sql\nDROP EXTENSION IF EXISTS plperl CASCADE;\nDROP EXTENSION IF EXISTS plperlu CASCADE;\n```\n\n3. Optionally, remove the RPM package providing the language integration:\n```bash\ndnf remove postgresql-plperl\n```\n\nCaveats:\nRevoking access or dropping the extension will break existing database stored procedures and functions that rely on PL/Perl.\n\nWarning:\nDatabase-level privilege and extension changes do not require restarting the postgresql service, but active client sessions should be terminated to enforce privilege revocations immediately.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via uncaught exceptions in PL/Perl"
},
{
"cve": "CVE-2026-116327",
"cwe": {
"id": "CWE-205",
"name": "Observable Behavioral Discrepancy"
},
"discovery_date": "2026-11-12T14:33:49.900708+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572572"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can bypass security barrier view protections to infer sensitive values that should remain restricted. By executing queries that apply custom or user-defined functions against internal test values representing protected columns, an attacker can disclose unauthorized data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure via security barrier view bypass",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an authenticated database session with privileges to query security-barrier views, restricting the scope strictly to unauthorized data inference. Standard Red Hat deployments are primarily at risk when multi-tenant architectures or row-level security policies rely on security barriers to segregate sensitive records from less-privileged users who can run arbitrary expressions. The flaw does not grant administrative privileges, allow modification of database contents, or enable remote code execution on the host system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116327"
},
{
"category": "external",
"summary": "RHBZ#2572572",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572572"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116327",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116327"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116327",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116327"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116327/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116327/"
}
],
"release_date": "2026-11-12T14:15:15.661000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Information disclosure via security barrier view bypass"
},
{
"cve": "CVE-2026-116328",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-11-12T14:33:15.152622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572562"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An integer wraparound vulnerability in memory context management allows an authenticated database user to execute arbitrary code with the privileges of the operating system user running the database. By freeing a memory allocation exceeding one gigabyte (1 GB), the system improperly reuses memory blocks due to an offset calculation error, resulting in memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via integer wraparound in memory contexts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important rather than Critical because exploitation requires existing database user credentials, yet enables arbitrary code execution within the operating system context of the PostgreSQL daemon. By default on Red Hat Enterprise Linux, PostgreSQL is configured to accept only local connections, limiting exposure unless remote network access has been specifically granted. Any authenticated user capable of executing resource-intensive queries that trigger large memory allocations can induce this memory corruption, though releases prior to PostgreSQL 16 remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116328"
},
{
"category": "external",
"summary": "RHBZ#2572562",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572562"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116328",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116328"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116328",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116328"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116328/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116328/"
}
],
"release_date": "2026-11-12T14:15:16.239000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Limit network access to the PostgreSQL service to trusted hosts or localhost to restrict exposure to untrusted networks.\n\n1. Restrict PostgreSQL network access using firewalld to only trusted management subnets:\n```\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=192.168.1.0/24\nfirewall-cmd --reload\n```\n\n2. Alternatively, ensure the server only binds to loopback interfaces by setting `listen_addresses = \u0027localhost\u0027` in the PostgreSQL configuration and reloading the service:\n```\nsystemctl reload postgresql\n```\n\nCaveats:\nRestricting network access only limits the attack surface from external untrusted networks. It does not prevent exploitation by authenticated database users connecting from permitted IP addresses or via local connections.\n\nWarning:\nReloading firewall rules or the PostgreSQL service modifies active connection filtering and client sessions. Plan and test these configuration adjustments to avoid unintended service interruption.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via integer wraparound in memory contexts"
},
{
"cve": "CVE-2026-116329",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:32:41.450693+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572554"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A type confusion vulnerability in the statistics import mechanism allows an authenticated user with table maintenance privileges to execute arbitrary code with the permissions of the operating system user running the database service. An attacker can trigger this issue by supplying nested SET DATA TYPE commands during the conversion of imported statistical values.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: arbitrary code execution via nested SET DATA TYPE during statistics import",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is evaluated as Important because authenticated users with table modification rights could execute arbitrary commands under the privileges of the database service account. However, Red Hat Enterprise Linux environments deploy PostgreSQL streams earlier than version 18, which do not contain the vulnerable statistics import functionality. Consequently, default installations on supported Red Hat platforms are not impacted by this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116329"
},
{
"category": "external",
"summary": "RHBZ#2572554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572554"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116329",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116329"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116329",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116329"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116329/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116329/"
}
],
"release_date": "2026-11-12T14:15:16.818000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: arbitrary code execution via nested SET DATA TYPE during statistics import"
},
{
"cve": "CVE-2026-116330",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code"
},
"discovery_date": "2026-11-12T14:32:29.727115+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572551"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. When backing up a database using the pg_dump utility with tar-format archives, the generated restore script uses a predictable restriction key. A compromised or malicious database server can exploit this flaw by injecting untrusted data, leading to arbitrary code execution with the operating system privileges of the client account running the restore command.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via predictable restriction key in pg_dump restore script",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity for Red Hat because a compromised database server can achieve arbitrary code execution on client systems performing backups, directly impacting the integrity and confidentiality of the host environment. Under standard Red Hat Enterprise Linux configurations, database administrators typically interact with trusted internal databases and pg_dump produces plain-text backups by default rather than tar archives. However, if an administrator uses the optional tar format against an untrusted origin, executing the resulting restore script allows an attacker to run commands with the full privileges of the invoking operating system account.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116330"
},
{
"category": "external",
"summary": "RHBZ#2572551",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572551"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116330",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116330"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116330",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116330"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116330/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116330/"
}
],
"release_date": "2026-11-12T14:15:17.385000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Operational controls to mitigate this vulnerability include:\n\n1. Avoid generating tar-format archives from untrusted database instances. By default, `pg_dump` outputs plain-text SQL. If binary or compressed archive formats are required, use the custom format (`-F c`) or directory format (`-F d`) instead of the tar format (`-F t` or `--format=tar`):\n pg_dump -F c -d \u003cdatabase_name\u003e -f \u003cbackup_file\u003e.dump\n\n2. Do not execute the embedded `restore.sql` script directly using `psql`. Instead, restore custom-format archives using `pg_restore`:\n pg_restore -d \u003cdatabase_name\u003e \u003cbackup_file\u003e.dump\n\n3. Restrict backup routines to verified, trusted PostgreSQL servers and ensure client commands are executed under a dedicated, unprivileged operating system service account.\n\nCaveats: Automation pipelines or scripts requiring tar-formatted archives (`-F t`) or manual execution of `restore.sql` must be adjusted to use alternative dump formats or `pg_restore`. These adjustments affect client command-line utilities and do not require restarting database services.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via predictable restriction key in pg_dump restore script"
},
{
"cve": "CVE-2026-116331",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:33:28.727778+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572566"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated user with permission to create database objects can exploit this vulnerability to achieve arbitrary code execution as the operating system user running the database service. The issue occurs during query optimization when a user-defined aggregate function specifies a sort operator (SORTOP) that causes the query planner to treat different data types as identical. This data type confusion allows an attacker to manipulate internal memory and compromise the host system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via aggregate optimization type confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as having an Important severity for Red Hat deployments because, although successful exploitation leads to complete arbitrary code execution under the operating system account running the database service, it requires an authenticated attacker with permissions to define custom database objects rather than being exploitable by unauthenticated remote users. In typical enterprise environments, database access is restricted and standard application roles do not possess schema creation privileges, which limits the attack surface to trusted or privileged database accounts. However, in shared hosting or multi-tenant configurations where non-administrative users can create schemas and custom routines, an attacker could leverage this flaw to fully compromise the database host.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116331"
},
{
"category": "external",
"summary": "RHBZ#2572566",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572566"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116331",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116331"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116331",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116331"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116331/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116331/"
}
],
"release_date": "2026-11-12T14:15:17.983000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Revoke object creation permissions from untrusted database accounts and restrict network access to trusted administrative hosts.\n\n1. Revoke schema creation permissions to prevent users from defining custom aggregates:\n```sql\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\nREVOKE CREATE ON SCHEMA \u003cschema_name\u003e FROM \u003cusername\u003e;\n```\n\n2. Limit network access to trusted clients using firewalld:\n```bash\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --reload\n```\nAlternatively, restrict client access rules in `/var/lib/pgsql/data/pg_hba.conf` and apply the configuration:\n```bash\nsystemctl reload postgresql\n```\n\nCaveats: Revoking object creation privileges prevents non-administrative users and applications from creating or modifying custom database objects and schemas. Limiting network access will block queries from unlisted client hosts.\n\nWarning: Modifying firewall rules or reloading the PostgreSQL service (`systemctl reload postgresql`) affects service accessibility. Ensure configuration changes are applied during scheduled maintenance windows to prevent unexpected disruption to active sessions.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via aggregate optimization type confusion"
},
{
"cve": "CVE-2026-116332",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:31:08.984262+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572530"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability allows an authenticated database user with object creation privileges to execute arbitrary code with the permissions of the operating system user running the database service. The issue stems from a use-after-free flaw (accessing memory after it has been released) during portal setup, which occurs when user-defined code executes during query planning or execution startup and closes the portal currently being prepared.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free during portal setup",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated database user with privileges to create objects can execute arbitrary commands on the host operating system under the PostgreSQL service account. On typical Red Hat Enterprise Linux deployments, database instances are restricted to authorized applications and users, limiting immediate exposure. However, in shared or multi-tenant database environments where non-administrative users are granted rights to define custom routines, this flaw allows complete breakout from SQL execution contexts into the underlying host environment. While the prerequisite of having database credentials and object creation permissions reduces widespread automated exposure, the severe consequence of arbitrary code execution justifies an Important rather than Moderate rating.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116332"
},
{
"category": "external",
"summary": "RHBZ#2572530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572530"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116332",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116332"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116332/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116332/"
}
],
"release_date": "2026-11-12T14:15:18.550000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network access to trusted management hosts and revoke object creation privileges from non-administrative users:\n\n1. Limit network access to the PostgreSQL service using firewalld to permit only trusted IP addresses:\n```\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --permanent --zone=public --remove-port=5432/tcp\nfirewall-cmd --reload\n```\n\n2. Revoke permissions from untrusted roles to create objects and functions within database schemas:\n```\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n```\n\nCaveats: Restricting network traffic prevents external clients outside allowlisted subnets from accessing database services. Revoking schema creation privileges prevents non-administrative users from defining custom objects or tables until administrative approval is granted.\n\nWarning: Modifying firewall configurations or reloading firewall rules can disrupt active database network connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free during portal setup"
},
{
"cve": "CVE-2026-116333",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-11-12T14:31:25.269001+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572535"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with permission to create database objects can trigger a buffer over-read during parallel B-tree index scans by defining a function incorrectly marked as parallel safe or stable. This issue causes participating worker processes to generate inconsistent search keys, allowing the attacker to read arbitrary server memory and resulting in sensitive information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure via buffer over-read in parallel B-tree scans",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity because exploitation requires an authenticated database user with permissions to create custom functions, limiting unauthorized remote access. While an attacker can trigger out-of-bounds memory reads via manipulated parallel query scans, the flaw does not grant write access, data modification, or direct code execution. Earlier major database releases supported across standard enterprise platforms do not implement the vulnerable parallel scan mechanism and are not susceptible to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116333"
},
{
"category": "external",
"summary": "RHBZ#2572535",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572535"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116333",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116333"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116333",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116333"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116333/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116333/"
}
],
"release_date": "2026-11-12T14:15:19.133000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "To mitigate this issue without applying code fixes, parallel query execution can be disabled to prevent PostgreSQL from launching parallel workers for index scans:\n\n1. Disable parallel worker processes by setting `max_parallel_workers_per_gather` to `0`. This can be applied across the instance by executing the following SQL command as an administrative user:\n\nALTER SYSTEM SET max_parallel_workers_per_gather = 0;\nSELECT pg_reload_conf();\n\nAlternatively, add or modify the setting in `/var/lib/pgsql/data/postgresql.conf`:\n\nmax_parallel_workers_per_gather = 0\n\nThen reload the PostgreSQL service:\n\nsystemctl reload postgresql\n\n2. As a supplementary operational control, restrict `CREATE` permissions on schemas and databases to trusted administrators to prevent untrusted users from declaring custom functions.\n\nCaveats:\nDisabling parallel query execution forces queries to run in a single process, which can degrade query performance on analytical workloads or large table scans.\n\nWarning: Reloading PostgreSQL configuration files will apply changes to new queries and sessions without dropping active connections, but query execution characteristics will change immediately.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Information disclosure via buffer over-read in parallel B-tree scans"
},
{
"cve": "CVE-2026-116335",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:33:42.751178+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572570"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with permissions to create database objects can trigger a type confusion issue by creating operator commutator or negator links with mismatched result types or inconsistent reciprocal links. Successful exploitation allows an attacker to execute arbitrary code on the host system with the privileges of the operating system user running the database server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via operator link type confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important severity rather than Critical because exploitation requires valid database credentials with schema-creation privileges, although arbitrary code execution under the database daemon presents a severe host and data risk. In standard Red Hat Enterprise Linux environments, the database server runs under a dedicated service account, but successful exploitation permits full compromise of all managed databases and local files accessible to the service. Deployments are primarily exposed when untrusted accounts possess permissions to define custom database objects.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116335"
},
{
"category": "external",
"summary": "RHBZ#2572570",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572570"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116335",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116335"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116335",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116335"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116335/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116335/"
}
],
"release_date": "2026-11-12T14:15:19.796000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict access to the PostgreSQL service to trusted hosts and revoke schema creation privileges from untrusted database users.\n\n1. Restrict PostgreSQL network reachability using firewalld:\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --reload\n\nAlternatively, restrict client addresses in pg_hba.conf and reload the service:\nsystemctl reload postgresql\n\n2. Revoke object creation permissions on database schemas to prevent unprivileged users from defining operators:\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n\nCaveats: Revoking schema creation privileges prevents non-administrative database users from defining new objects, which may break applications that create custom or temporary entities. Restricting network access prevents external connections from non-allowlisted systems.\n\nWarning: Reloading firewall rules or reloading the PostgreSQL service via `systemctl reload postgresql` applies configuration changes immediately. Ensure that changes to pg_hba.conf are validated prior to reloading to avoid service disruptions.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via operator link type confusion"
},
{
"cve": "CVE-2026-116336",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:33:18.782060+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572563"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with privileges to create objects can execute arbitrary code on the host system as the operating system user running the database service. This vulnerability occurs when the REINDEX CONCURRENTLY operation processes an index expression that executes a DROP INDEX command, resulting in an unsafe operation on a dropped index.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via dropped index in REINDEX CONCURRENTLY",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important severity because, while it requires an attacker to possess existing database credentials with object creation privileges, it allows privilege escalation to arbitrary code execution within the context of the underlying database daemon account. In standard Red Hat deployments hosting shared or multi-tenant database clusters, this flaw permits an authorized user to break through SQL isolation boundaries during concurrent reindexing workflows. Environments where database object creation is strictly confined to fully trusted administrative roles experience significantly lower practical exposure.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-116336"
},
{
"category": "external",
"summary": "RHBZ#2572563",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572563"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-116336",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-116336"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-116336",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116336"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-116336/",
"url": "https://www.postgresql.org/support/security/CVE-2026-116336/"
}
],
"release_date": "2026-11-12T14:15:20.347000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via dropped index in REINDEX CONCURRENTLY"
},
{
"cve": "CVE-2026-120139",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-11-12T14:34:18.288743+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572580"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An integer wraparound (an arithmetic calculation exceeding numerical limits) occurs during in-memory tuple-size calculations when handling oversized data. An authenticated database user can exploit this flaw to execute arbitrary code with the privileges of the operating system user running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via integer wraparound in tuple-size calculations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as an Important impact by Red Hat Product Security because an authenticated database user can achieve arbitrary code execution within the context of the postgres system user, compromising host and database integrity. While standard deployments on Red Hat Enterprise Linux confine the database process using a dedicated service account and SELinux, exploitation fully exposes the database engine and any data accessible to it. Exploitation requires network reachability and valid database login credentials to submit queries containing crafted, oversized row records. Unauthenticated remote attackers cannot trigger this issue directly.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120139"
},
{
"category": "external",
"summary": "RHBZ#2572580",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572580"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120139",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120139"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120139",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120139"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120139/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120139/"
}
],
"release_date": "2026-11-12T14:15:20.956000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network exposure to the PostgreSQL service so that only trusted client hosts and authorized administrators can establish connections.\n\n1. Using firewalld, restrict incoming connections on PostgreSQL port 5432 to a trusted IP address or subnet:\n```\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003cTRUSTED_IP_RANGE\u003e\nfirewall-cmd --reload\n```\n\n2. Alternatively, configure PostgreSQL to bind only to local interfaces by modifying `listen_addresses` in `/var/lib/pgsql/data/postgresql.conf`:\n```\nlisten_addresses = \u0027localhost\u0027\n```\nApply the configuration change by restarting the service:\n```\nsystemctl restart postgresql\n```\n\nCaveats:\nRestricting network connectivity or interface binding prevents remote clients and applications outside the allowed subnet from connecting to the database.\n\nWarning:\nRestarting or reloading the PostgreSQL service terminates active client connections and temporarily interrupts database availability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via integer wraparound in tuple-size calculations"
},
{
"cve": "CVE-2026-120141",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:31:12.201951+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572531"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A type confusion vulnerability in materialized set-returning functions allows an authenticated database user to execute arbitrary code on the server with the privileges of the operating system user running the database. By returning rows with differing dynamic record types (such as through the json_populate_recordset() function), the database misinterprets data types in memory, leading to arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in materialized set-returning functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated database user can achieve arbitrary code execution under the privileges of the operating system account running the PostgreSQL service. While exploiting the issue requires valid database credentials, it allows standard database users without superuser privileges to breach host boundaries and compromise the underlying operating system process. In Red Hat Enterprise Linux environments where databases serve multiple applications or untrusted tenants, this enables direct escalation from database access to local host compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120141"
},
{
"category": "external",
"summary": "RHBZ#2572531",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572531"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120141",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120141"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120141",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120141"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120141/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120141/"
}
],
"release_date": "2026-11-12T14:15:21.515000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network access to the PostgreSQL service so that only trusted client IP addresses can establish connections, and avoid provisioning database accounts to untrusted users.\n\n1. Using firewalld, restrict PostgreSQL access (default port 5432/tcp) to trusted IP addresses or subnets:\n```sh\nfirewall-cmd --permanent --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_range\u003e\nfirewall-cmd --reload\n```\n\n2. Alternatively, restrict client connection access in `/var/lib/pgsql/data/pg_hba.conf` to specific trusted addresses, then reload the service:\n```sh\nsystemctl reload postgresql\n```\n\nCaveats:\nRestricting network access limits exposure from untrusted networks, but any authenticated database user connecting from an authorized host can still trigger the vulnerability.\n\nWarning: Reloading firewall configuration or the PostgreSQL service may momentarily interrupt active network connections. Verify that administrative management sources are included in trusted rules prior to reloading to avoid losing remote access.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in materialized set-returning functions"
},
{
"cve": "CVE-2026-120142",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:32:21.621240+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572549"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with object creation privileges can exploit this vulnerability to execute arbitrary code on the host as the operating system user running the database service. By defining row types with dropped attributes in identical positions but differing data widths or alignments, an attacker triggers a type confusion condition within anonymous record types.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in anonymous RECORD types",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Critical because successful exploitation requires valid database credentials with permissions to define schema objects, preventing unauthenticated remote attackers from triggering the issue. Once authenticated with object creation privileges, a malicious user can achieve arbitrary code execution under the operating system account running the PostgreSQL service, leading to full compromise of database confidentiality, integrity, and availability. PostgreSQL deployments on versions prior to 17 are unaffected because they lack the vulnerable anonymous record handling logic.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120142"
},
{
"category": "external",
"summary": "RHBZ#2572549",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572549"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120142",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120142"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120142",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120142"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120142/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120142/"
}
],
"release_date": "2026-11-12T14:15:22.150000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in anonymous RECORD types"
},
{
"cve": "CVE-2026-120143",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:31:54.934249+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572542"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A use-after-free vulnerability in trigger functions allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database. By defining a cursor over a transition table within a trigger function, an attacker can access previously freed memory, resulting in memory corruption and full compromise of the database service process.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in trigger functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an authenticated database user with permissions to create database objects can achieve arbitrary code execution under the privileges of the postgres operating system account. Although exploiting the flaw requires network access and schema manipulation rights, the resulting use-after-free condition breaks database boundaries and compromises the host service process. Multi-tenant database deployments that grant object creation rights to untrusted roles face the highest risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120143"
},
{
"category": "external",
"summary": "RHBZ#2572542",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572542"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120143",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120143"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120143",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120143"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120143/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120143/"
}
],
"release_date": "2026-11-12T14:15:22.843000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "1. Summary of action:\nRestrict PostgreSQL network access to trusted management networks and revoke object creation privileges from untrusted database users.\n\n2. Configuration and command examples:\nLimit incoming traffic to the PostgreSQL service port (TCP 5432) to trusted hosts or subnets using firewalld:\n# firewall-cmd --permanent --remove-service=postgresql\n# firewall-cmd --permanent --add-rich-rule=\u0027rule family=\"ipv4\" source address=\"\u003ctrusted_ip_or_subnet\u003e\" port port=\"5432\" protocol=\"tcp\" accept\u0027\n# firewall-cmd --reload\n\nWithin PostgreSQL, remove schema creation rights from unprivileged accounts:\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n\nAdditionally, restrict allowed client addresses in pg_hba.conf to trusted hosts only.\n\n3. Caveats:\nRestricting network access will block database connections from unauthorized or unlisted client IP addresses. Revoking CREATE privileges prevents non-administrative users from creating new tables, views, or triggers.\n\n4. Warning:\nApplying firewall modifications requires reloading firewalld, which applies network policy changes immediately. Modifying pg_hba.conf requires a service reload (such as \u0027systemctl reload postgresql\u0027) for changes to take effect.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in trigger functions"
},
{
"cve": "CVE-2026-120144",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:31:18.717420+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572533"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. Incomplete type-cache invalidation allows an authenticated user with permission to create database objects to trigger type confusion by modifying a composite data type while its cache entry is being populated. A successful exploit enables the attacker to execute arbitrary code on the host system with the operating system privileges of the running database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Arbitrary code execution via incomplete type-cache invalidation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important rather than Critical because exploitation requires an attacker to possess valid database credentials with permissions to define or modify schema objects. If exploited, an attacker can trigger memory corruption through composite type changes, resulting in arbitrary code execution under the privileges of the database service account. Red Hat Enterprise Linux platforms primarily distribute earlier major releases of the database server, which do not contain this caching defect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120144"
},
{
"category": "external",
"summary": "RHBZ#2572533",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572533"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120144",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120144"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120144",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120144"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120144/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120144/"
}
],
"release_date": "2026-11-12T14:15:23.436000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL: Arbitrary code execution via incomplete type-cache invalidation"
},
{
"cve": "CVE-2026-120145",
"cwe": {
"id": "CWE-250",
"name": "Execution with Unnecessary Privileges"
},
"discovery_date": "2026-11-12T14:32:37.226335+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572553"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. Missing authorization checks in logical replication allow a compromised publisher to execute arbitrary code as the operating system user running the database service. An attacker controlling a publishing database can exploit this vulnerability by designating an internal system catalog table as a replication target for a superuser-owned subscription.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via system catalog replication target",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this vulnerability as Important because an attacker controlling an upstream publisher can achieve arbitrary remote code execution under the postgres operating system user account on the subscriber host. In default Red Hat Enterprise Linux installations, PostgreSQL does not establish logical replication subscriptions out of the box, significantly limiting ambient exposure. The security risk is restricted to specific environments where an administrator has configured a superuser-owned subscription that pulls changes from an untrusted or compromised external database instance.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120145"
},
{
"category": "external",
"summary": "RHBZ#2572553",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572553"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120145",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120145"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120145",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120145"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120145/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120145/"
}
],
"release_date": "2026-11-12T14:15:23.991000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Disable logical replication subscriptions connected to untrusted publisher databases, or reassign subscription ownership to an unprivileged database role.\n\n1. Disable an untrusted subscription directly from the PostgreSQL prompt:\nALTER SUBSCRIPTION \u003csubscription_name\u003e DISABLE;\n\n2. Alternatively, transfer the subscription ownership away from a superuser:\nALTER SUBSCRIPTION \u003csubscription_name\u003e OWNER TO \u003cnon_superuser_role\u003e;\n\n3. Restrict outgoing network connections to unverified publisher hosts at the network or firewall level.\n\nCaveats: Disabling subscriptions halts data synchronization between publisher and subscriber tables until manually re-enabled. Non-superuser roles must have adequate table privileges to apply replicated data.\nWarning: Modifying subscriptions or applying firewall changes interrupts active replication sessions but does not require a PostgreSQL service restart.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via system catalog replication target"
},
{
"cve": "CVE-2026-120146",
"cwe": {
"id": "CWE-267",
"name": "Privilege Defined With Unsafe Actions"
},
"discovery_date": "2026-11-12T14:33:59.929391+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572575"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with limited privileges can bypass authorization checks when executing the REASSIGN OWNED command. This flaw allows the user to reassign database or object ownership without the required administrative privileges, leading to unauthorized modification of database assets.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Authorization bypass via REASSIGN OWNED command",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because exploitation requires authenticated database credentials with specific role inheritance privileges, limiting the blast radius to database-internal object ownership without allowing host-level privilege escalation or arbitrary code execution. Under default Red Hat enterprise deployments, database access is restricted to authenticated roles and network access is controlled. Although an authenticated user can bypass intended ownership assignment checks via the reassignment command, the flaw does not directly compromise confidentiality or database availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120146"
},
{
"category": "external",
"summary": "RHBZ#2572575",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572575"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120146",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120146"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120146",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120146"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120146/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120146/"
}
],
"release_date": "2026-11-12T14:15:24.583000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: PostgreSQL: Authorization bypass via REASSIGN OWNED command"
},
{
"cve": "CVE-2026-120147",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:33:03.538431+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572559"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the PostgreSQL dblink extension. A use-after-free vulnerability allows an authenticated database user with object creation privileges to execute arbitrary code as the operating system user running the database. This flaw is triggered when custom type conversion logic re-enters the dblink extension and closes an active connection while an outer query is still reading its results.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in dblink extension",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has evaluated this vulnerability as an Important severity risk because an authenticated database user capable of creating database objects can achieve arbitrary code execution under the operating system identity of the PostgreSQL server daemon. While the flaw permits severe host-level compromise, exploitation is bounded by the prerequisite of having existing database access, permissions to declare custom types, and an active installation of the optional dblink extension. In standard Red Hat Enterprise Linux configurations, dblink is not enabled by default.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120147"
},
{
"category": "external",
"summary": "RHBZ#2572559",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572559"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120147",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120147"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120147",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120147"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120147/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120147/"
}
],
"release_date": "2026-11-12T14:15:25.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "If the dblink extension is not required by your applications, remove it from all affected databases using the following command in a psql session:\n\nDROP EXTENSION IF EXISTS dblink CASCADE;\n\nIf the extension is required, mitigate exposure by preventing untrusted database users from defining custom objects (such as types and functions), for example by revoking create privileges on public schemas:\n\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n\nAdditionally, revoke execute permissions on dblink functions from untrusted roles.\n\nCaveats: Dropping the extension or revoking schema permissions will break applications and automated tasks that rely on dblink cross-database queries or object creation. These SQL operations take effect immediately and do not require a database service restart or reload.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in dblink extension"
},
{
"cve": "CVE-2026-120148",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:32:45.772059+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572555"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A type confusion vulnerability in the extended statistics component allows an authenticated database user with object creation permissions to execute arbitrary code as the operating system user running the database. By defining an extended statistics expression with an anonymous record type, an attacker can cause data types to be misinterpreted across database sessions, leading to memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via type confusion in extended statistics",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an authenticated user with permissions to create database objects can escalate privileges to execute code in the context of the underlying postgres operating system service account. The requirement for valid authentication credentials and object creation rights prevents this from being a Critical issue, as it cannot be triggered by unauthenticated network callers. However, in shared database environments where multiple users or applications possess schema creation privileges, an attacker can break tenant isolation and achieve full access to host database assets.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120148"
},
{
"category": "external",
"summary": "RHBZ#2572555",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572555"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120148",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120148"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120148",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120148"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120148/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120148/"
}
],
"release_date": "2026-11-12T14:15:25.724000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict exposure by limiting network reachability to the PostgreSQL service and removing object creation privileges from untrusted database accounts.\n\n1. Restrict PostgreSQL network access to trusted hosts using firewalld:\n# firewall-cmd --permanent --remove-service=postgresql\n# firewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\n# firewall-cmd --reload\n\n2. Alternatively, configure PostgreSQL to bind only to local or trusted internal network interfaces in postgresql.conf:\nlisten_addresses = \u0027localhost, \u003ctrusted_internal_ip\u003e\u0027\n\nApply configuration changes by reloading the service:\n# systemctl reload postgresql\n\n3. Restrict database privileges so that untrusted database users cannot create objects or custom statistics:\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n\nCaveats:\nRestricting network connectivity blocks database access from unlisted client systems. Revoking schema creation privileges prevents non-administrative database users from creating tables or statistics, which may disrupt applications that rely on dynamic schema modification.\n\nWarning:\nReloading firewalld or the PostgreSQL service immediately alters network packet filtering and re-reads database daemon configurations. Ensure changes are verified in staging environments before applying them in production.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via type confusion in extended statistics"
},
{
"cve": "CVE-2026-120149",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-11-12T14:32:17.900309+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572548"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A heap-based buffer overflow vulnerability in foreign batch insert operations allows a foreign server to execute arbitrary code. This issue occurs when a remote foreign server reports that it inserted more data rows than the local database server supplied, leading to memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via foreign batch inserts",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important severity because an attacker controlling an external data source could achieve remote code execution within the PostgreSQL server process by returning malformed row counts during batch write operations. Default deployments are not exposed unless administrators configure foreign data wrappers such as postgres_fdw to interact with remote endpoints. The impact is therefore constrained to setups interacting with untrusted foreign servers or remote schemas with expanding rewrite rules.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120149"
},
{
"category": "external",
"summary": "RHBZ#2572548",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572548"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120149",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120149"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120149",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120149"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120149/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120149/"
}
],
"release_date": "2026-11-12T14:15:26.749000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via foreign batch inserts"
},
{
"cve": "CVE-2026-120150",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:32:13.020037+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572547"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. A use-after-free memory vulnerability exists during expanded-record domain checks. An authenticated database user with object creation permissions can trigger this issue by performing repeated domain checks over composite data types, leading to the reuse of freed memory. Successful exploitation allows the attacker to execute arbitrary code on the underlying system with the privileges of the operating system user running the database service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via use-after-free in expanded-record domain checks",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an authenticated database user with privileges to define composite types and domains can break database process boundaries to run arbitrary code on the underlying host under the service account. While exploitation requires existing authentication and schema creation permissions rather than being unauthenticated, achieving host-level execution elevates the severity beyond Moderate due to the total loss of system confidentiality, integrity, and availability for the database server. In standard Red Hat Enterprise Linux environments hosting PostgreSQL, database roles granted schema creation privileges can trigger this flaw without requiring administrative or superuser rights, exposing multi-tenant database deployments to full host compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120150"
},
{
"category": "external",
"summary": "RHBZ#2572547",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572547"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120150",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120150"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120150",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120150"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120150/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120150/"
}
],
"release_date": "2026-11-12T14:15:27.323000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via use-after-free in expanded-record domain checks"
},
{
"cve": "CVE-2026-120151",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type"
},
"discovery_date": "2026-11-12T14:32:50.021600+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572556"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. This vulnerability allows an authenticated user with database object creation privileges to execute arbitrary code with the permissions of the operating system account running the database service. The issue stems from a type confusion condition in the PL/pgSQL (Procedural Language/PostgreSQL) engine during record-field assignments, where a re-entrant domain check alters a record variable\u0027s structure while casting a value.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Arbitrary code execution via PL/pgSQL type confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Important because an authenticated database user with permission to create database objects can escalate privileges and achieve arbitrary code execution as the PostgreSQL operating system service account. Although exploitation requires existing network access and non-trivial database creation privileges\u2014precluding unauthenticated attackers\u2014the flaw circumvents standard database engine isolation to fully compromise database host integrity and confidentiality. Standard hardened Red Hat Enterprise Linux deployments that restrict database object creation to administrative accounts substantially limit exposure to this flaw.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120151"
},
{
"category": "external",
"summary": "RHBZ#2572556",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572556"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120151",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120151"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120151/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120151/"
}
],
"release_date": "2026-11-12T14:15:27.877000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Restrict network exposure of the PostgreSQL service to trusted client hosts and remove database object creation privileges from untrusted accounts:\n\n1. Restrict client connections in `/var/lib/pgsql/data/pg_hba.conf` to authorized IP addresses only, then reload the database configuration:\n```\nsystemctl reload postgresql\n```\n\n2. Revoke object creation permissions from untrusted database users on the public schema:\n```\nREVOKE CREATE ON SCHEMA public FROM PUBLIC;\n```\n\nCaveats: Restricting connection rules blocks access from unlisted clients. Revoking schema creation privileges prevents non-administrative users from defining custom tables, types, or PL/pgSQL functions, which may impact applications that perform dynamic schema changes.\n\nWarning: Reloading the PostgreSQL service or modifying network filter rules applies changes immediately and can terminate or disrupt existing connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: Arbitrary code execution via PL/pgSQL type confusion"
},
{
"cve": "CVE-2026-120152",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-11-12T14:33:22.075505+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572564"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user can trigger a use-after-free vulnerability by loading a module while the pg_show_all_settings() function is scanning custom-variable placeholders that the module replaces and frees. Successful exploitation allows the user to read internal memory contents, resulting in unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: Information disclosure via use-after-free in pg_show_all_settings()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate severity rather than Important because exploitation requires an authenticated database session and the impact is strictly limited to unauthorized reading of server process memory without permitting data modification or service disruption. In standard Red Hat deployments, PostgreSQL access is restricted to authorized users, which limits exposure to accounts already permitted to execute configuration routines and load modules. Additionally, environments running releases prior to PostgreSQL version 16 do not contain the vulnerable code path and remain unaffected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120152"
},
{
"category": "external",
"summary": "RHBZ#2572564",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572564"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120152",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120152"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120152",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120152"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120152/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120152/"
}
],
"release_date": "2026-11-12T14:15:28.444000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: postgresql: Information disclosure via use-after-free in pg_show_all_settings()"
},
{
"cve": "CVE-2026-120153",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command"
},
"discovery_date": "2026-11-12T14:33:46.657938+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572571"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated user with database-level CREATE privileges can execute arbitrary code as the administrative superuser through a Structured Query Language (SQL) injection vulnerability in extension-script substitutions. By supplying a crafted schema or owner name containing newlines or special characters to an affected extension script, an attacker can manipulate script execution to achieve privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: postgresql: arbitrary code execution via SQL injection in extension-script substitutions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat has rated this vulnerability as having an impact of Important because successful exploitation allows an authenticated database user to escalate privileges to the administrative superuser, potentially executing code on the underlying host system. The flaw requires specific prerequisites: the user must possess database-level CREATE privileges, and the database must use an external, non-bundled extension containing vulnerable script substitution patterns. Default PostgreSQL installations provided with Red Hat enterprise distributions do not include these vulnerable extension scripts, limiting risk to environments that deploy unverified third-party extensions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120153"
},
{
"category": "external",
"summary": "RHBZ#2572571",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572571"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120153",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120153"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120153/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120153/"
}
],
"release_date": "2026-11-12T14:15:29.010000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Revoke database-level CREATE privileges from untrusted users, avoid installing non-bundled third-party extensions, and restrict PostgreSQL network connectivity to trusted management networks.\n\n1. Revoke database creation permissions using SQL:\nREVOKE CREATE ON DATABASE \u003cdatabase_name\u003e FROM \u003cusername\u003e;\n\n2. Restrict PostgreSQL network access to trusted sources using firewalld:\nfirewall-cmd --permanent --zone=public --remove-service=postgresql\nfirewall-cmd --permanent --zone=trusted --add-source=\u003ctrusted_ip_or_subnet\u003e\nfirewall-cmd --reload\n\nCaveats:\nRevoking CREATE rights prevents affected database users from creating new schemas or database objects, which may break applications that rely on dynamic object creation. Limiting firewall access prevents incoming database connections from unauthorized networks.\n\nWarning:\nModifying firewall settings requires a reload using `firewall-cmd --reload`. If modifying access controls within `pg_hba.conf` or `postgresql.conf`, execute `systemctl reload postgresql` to apply changes without restarting the daemon or terminating active client connections.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: postgresql: arbitrary code execution via SQL injection in extension-script substitutions"
},
{
"cve": "CVE-2026-120154",
"cwe": {
"id": "CWE-268",
"name": "Privilege Chaining"
},
"discovery_date": "2026-11-12T14:32:33.469956+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2572552"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can bypass Row-Level Security (RLS) policies, leading to unauthorized information disclosure. By executing iterated INSERT ... ON CONFLICT DO UPDATE statements, an attacker can read protected rows that should otherwise be restricted by security policies.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL: Row-level security bypass via INSERT ON CONFLICT DO UPDATE",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This vulnerability is rated as Moderate because exploitation requires an authenticated database user who already possesses substantial table-level rights (such as INSERT, UPDATE, and SELECT) alongside tables with active Row-Level Security. In standard Red Hat environments, Row-Level Security policies are disabled by default and require explicit administrative activation per table. Additionally, the flaw is restricted to unintended row retrieval, preventing unauthorized data modification or host compromise.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-120154"
},
{
"category": "external",
"summary": "RHBZ#2572552",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2572552"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-120154",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-120154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-120154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120154"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-120154/",
"url": "https://www.postgresql.org/support/security/CVE-2026-120154/"
}
],
"release_date": "2026-11-12T14:15:29.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-11-12T18:37:59+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\nhttps://images.redhat.com/",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:99821"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@src",
"Red Hat Hardened Images:libpq-0:18.7-0.1.hum1@x86_64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@aarch64",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@s390x",
"Red Hat Hardened Images:libpq-devel-0:18.7-0.1.hum1@x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "postgresql: PostgreSQL: Row-level security bypass via INSERT ON CONFLICT DO UPDATE"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
How durations are calculated
Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.
Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.