Red Hat Product Errata RHSA-2026:26203 - Security Advisory Issued: 2026-06-16 Updated: 2026-06-16 RHSA-2026:26203 - Security Advisory Overview Updated Packages Synopsis Important: postgresql:16 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the postgresql:16 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.src.rpm SHA-256: e6c2e8be2887a9cbf7ef2fbdc0ca210b89916ea8a5cbc10a32aadc10c1265b4e pgaudit-16.0-1.module+el9.8.0+24090+8f0ee565.src.rpm SHA-256: bf2e97d6d84a1292a5b81526ef1f2c95d1f612e7edca9687e886b0f99b2e76ba pgvector-0.6.2-2.module+el9.8.0+24090+8f0ee565.src.rpm SHA-256: 1e4d6789b3b02001be5cf490d6ec0b30536541a0f5dd8277965616779d861855 postgis-3.5.3-5.module+el9.8.0+24090+8f0ee565.src.rpm SHA-256: e853034f252e7e7732d24178cf0a05132c9ad0426e78948b58144464d4dff7ff postgres-decoderbufs-2.4.0-1.Final.module+el9.8.0+24090+8f0ee565.src.rpm SHA-256: 3d02d1f79d4edee6a254e13e52e333b9c8adee09b945d5b5e23102cb6fb10225 postgresql-16.14-1.module+el9.8.0+24360+ff98e86a.src.rpm SHA-256: a6e5d5ae3807b707632863dd9f2c628d7b269710433ab0af08ab65ee678b8e45 x86_64 postgresql-test-rpm-macros-16.14-1.module+el9.8.0+24360+ff98e86a.noarch.rpm SHA-256: 7fda070a7963689c544daa5f49be1ca9b69d105f133700a8ea56f56a5213fcfd pg_repack-1.5.1-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: dbfab9d79ddaeb6a5a858ee7293977d1035d62583013feb550c8fd87d44ecdc1 pg_repack-debuginfo-1.5.1-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 8cfe1a241e9cdd0349305c48397731e586add9090a2e0993f8d3db4d76401637 pg_repack-debugsource-1.5.1-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: fed8a14a731da02e81db2f21106d731b0a87513f223d49b3ef8b12228202b76e pgaudit-16.0-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: fb819e23825a8bf0ddf3cc8afb1f7b38ecf18005e168a793eb9090f6b9e6fc0c pgaudit-debuginfo-16.0-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: dfd71873732b5465f8d1b33ebb16006559987d029e3565cbebdb78dc84550d41 pgaudit-debugsource-16.0-1.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 864b91ae4934e0918848aea5ac9a15fd7bec0ac9702be24fa0e2dc0c8ef39671 pgvector-0.6.2-2.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 4546c45c8687e59177ec6df8bb4545e6e40d642a8819f93ec2e57ab6f2e993ee pgvector-debuginfo-0.6.2-2.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 9c9e67c54060cfd398304f06123543629a1196c1b67d28b17c6ddf8119483f39 pgvector-debugsource-0.6.2-2.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 292a49cebf3f50f0502f1fab41ff4e40869501cc2a9f0fbca11d0eb22cd90dfb postgis-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 7cf7e2c2116ee5ab6fb0bee2083689192a668a2b2a0a2ea0149a99cb038bdfde postgis-client-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: b5ce7bec882f123592ff5cb108751099e18e913f53db7fccaf0059d2f149c673 postgis-client-debuginfo-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 4c961b2ccc686704c35ac57df657c6490f278d60fb9d1d2d4da12889ad29febf postgis-debuginfo-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: ee83be3aecbcbe527e2b03aa408f72a8b55d5c8f9c5013a13db92030859d7db6 postgis-debugsource-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: fc38948a2e6fe13829953d59c49b3fc920e45b6a4879ecf31ead58f02c9ef6d0 postgis-docs-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: de3887c4fd0cc2ad8a7833b11f998956e57ca335e3fe6c345d88751d015e8176 postgis-upgrade-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 82fa5ae32ffd2cfb357569c3081d43e2e43017d2a765eac6eefc1d406bfe8fd8 postgis-upgrade-debuginfo-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: ae2e84c02130f4bbec6e8ec0612c13e269c4dd8a08445d26e108d220840827d8 postgis-utils-3.5.3-5.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: b583ea354b697ad36cacb999c03f2f2e8fe1feeef181fdc6deae920b46e33f3b postgres-decoderbufs-2.4.0-1.Final.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: 7ea4fc586eae1df62bea5ca52fd579df621547e23328bcb241462fd4e2e9380a postgres-decoderbufs-debuginfo-2.4.0-1.Final.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: fbed398385ac6a700009b56200a2efad199b9a063e494d9376465ff160027ec5 postgres-decoderbufs-debugsource-2.4.0-1.Final.module+el9.8.0+24090+8f0ee565.x86_64.rpm SHA-256: a4a0b9628e2699ffd393be657b3c0b30eb01acf8f201dbe8ada68a20393879f6 postgresql-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 9325e51249f2c5c94ebe82805f66e37574f6757504b394f4c1ee44733a4d7b2d postgresql-contrib-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 114c44bfbd44aa7325cd53116b4d8b2379af0cc486580600a38d48fc17d537ed postgresql-contrib-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 24c960e236a6e8da4eaf2656b88fff1f8b88fc369c4f4bb96e5433a934be389f postgresql-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: cec7d9079a7c11c9c9566bced80d944ac8f9c6c5481e30aa2171e9615cdc9b5f postgresql-debugsource-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 4ea94e00aaedc9378fa1fe22d11030bd03281366e1479a22992859a89d49100d postgresql-docs-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 478bc6c1c7409e4ab3d3134b91b0ffade5c8e877b2a9d3eb902a2041dde27a08 postgresql-docs-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: ff55c1423d220c97ee7c5b56abfefd5ccb12adc077aec047ee2c71eaa008aef4 postgresql-plperl-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 45d68324db4fa1001890cb73a6444514952e0aeed1ab7fc883b8a5fa3479c058 postgresql-plperl-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 95e4bb192a2da2f0ca5b66559018a2736becdfd215f1e57ebba2cc5ea3438a84 postgresql-plpython3-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: b9169c205cfe6991a4404599615583adf4108e1c8ab0f9349769f9e035f5c0fe postgresql-plpython3-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: c8fef548933b2290850803696fc803bd898c035051d927d55a9e397568c8a307 postgresql-pltcl-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 845e99de0115f735cd2f355e673ae2ea1606c14a2b688f2d9a8889eb1f752f5d postgresql-pltcl-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 908370c4a113af25439847d9d34c32ab3f9e2b154b3e88806e7fa594e65e54de postgresql-private-devel-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: ec555a03c31125936b1e5af2da6a21477661c0cca4ce3e8a0a74d89756084441 postgresql-private-libs-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: c637e020443076818c6b8d271fc49090f52fef850b12aa3f1068d695293b9991 postgresql-private-libs-debuginfo-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 5c65539ac9c1af4649b29a2bd30801c3d3513cb84516c0a372fd3108e75d6785 postgresql-server-16.14-1.module+el9.8.0+24360+ff98e86a.x86_64.rpm SHA-256: 641f62934d2ab8c0719fef40d9fdb1328102b315bf09