This Important Red Hat security update addresses four vulnerabilities in PostgreSQL 15, including a high-severity symlink-following flaw in pg_basebackup and pg_rewind allowing OS account hijack (CVE-2026-6475, CVSS 8.8), a high-severity libpq buffer overflow enabling server superusers to overwrite client stack memory (CVE-2026-6477, CVSS 8.8), and a medium-severity timing channel for MD5 credential recovery (CVE-2026-6478, CVSS 6.5). Affected PostgreSQL versions are 15.0 through 15.17, and the fixed version is 15.18.
Red Hat Product Errata RHSA-2026:26561 - Security Advisory Issued: 2026-06-17 Updated: 2026-06-17 RHSA-2026:26561 - Security Advisory Overview Updated Packages Synopsis Important: postgresql:15 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the postgresql:15 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 SRPM pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: 9e33379e0420596251a48bf77e077377fd05c8fa7a8ab5d47b607924e2879d60 pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: 1acc6f1d6fb8106e2e4afad7bd9d82f1ab1f91353275e1240641db1edb622d28 postgres-decoderbufs-1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: c42e7b1bb1c425ebdf3a14522939d1aa6d5aafb38b5f9a94e29410a3709fadb4 postgresql-15.18-1.module+el8.8.0+24395+e7b9b4b6.src.rpm SHA-256: eaf2610712c84026158000462575853caec4529564caf6fd9c27a6b722720de8 x86_64 pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 0ca6419f733821b5d363c7ab6a483a0171ced8c73a739bfe3a0ab853fbe87e98 pg_repack-debuginfo-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: dc842e84c02bb77b52fe710633a914ec8383438a17a7d87bf7d4f8813a3cce80 pg_repack-debugsource-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 1a16bd8bca182248e684a47f4c3eb8d79570e9957072a072fca3790e5e6018ef pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: df9fc42e7683fc22a284fca4b0588697b9f3269d73ff9418263b97d035577d15 pgaudit-debuginfo-1.7.0-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: f579d52cf6bbb4dbb6d3c4a8a88496c913f235963696e096babdb2d02884942c pgaudit-debugsource-1.7.0-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 3d488464db9d8f4822162d1590b84afef5fc7f4b4d6045c873553d35b0ad6eac postgres-decoderbufs-1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 2dcef1fcf26007fac14f5f9d1da538c5a699189705513c1e34b57f9a5b65d41d postgres-decoderbufs-debuginfo-1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 2b23263b963aab3cedab01d038f3588484e6dde7b6784fd7abe601eb5d22ce73 postgres-decoderbufs-debugsource-1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 8386ac4505e178a6dd9922bc092a18e758279dd66a64b489d411ce862ef4c2c7 postgresql-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 37f756d5c1bd0023911cb70ba9c36beea8d995b9960040c00e4147e81945b3f2 postgresql-contrib-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: bef0bf343f4ac3acca9a3126cec7108dffb80000ebcc925ae453a4d26c8c385b postgresql-contrib-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 6ae86040e4f47a9c23ff5badf9c2d5079c0e36a6c13e322fdcd3803023103338 postgresql-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 0508005223a7eeb963b7ff5dd2780f6a22a46d8b9a67d4e504f482c2ff69ddc3 postgresql-debugsource-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 514ee2996b2bedfd1868052966d2bbcad78a21e094894149e381cc4260ca8da4 postgresql-docs-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 8c86057c52d2708a6eee8b0916865015ece364a9181bfac06a384c7b3ea11300 postgresql-docs-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 0e5a5773bc8bcd6f663b6e3b82343a0ac2b856ad3db23c0581e9f304b5ba5ff4 postgresql-plperl-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 627d7de8d44fd84b9cc7469508e6481f0977f4e52dcd530aa360a0e73b525703 postgresql-plperl-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 222a84bf95fdcd66c3743db3801d1f36c9afb195931ef685c6c792ee88ab80d7 postgresql-plpython3-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: d27b48a439d46731e4c83913cc54b9f87bf0bb8de920107da0aa327d074d9997 postgresql-plpython3-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 629e070e85e9fb73833e64cc4d91fb3b08b7f32c34b0a62fad21b604b05c3b99 postgresql-pltcl-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: c74abf9b5d35cb4ba8fa7875facbf322e6c7900424837f03790377cb8717573a postgresql-pltcl-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: ffcae7d5f09143b9806787b989b66416262bf0b11ce0ea61d117e8f455bdd112 postgresql-private-devel-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: df965b387ed53a14202fb37165a137a5960b052f8d14bf87714247e2e518803f postgresql-private-libs-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 8e4c9c211cf04302c57e0f56fc42e6c3a80f054e0fa33579842a7d22c218002c postgresql-private-libs-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: e0a469868d78139581eb95c6936b85dd5c1533b508eb09193adff8f66f72bfe7 postgresql-server-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 1cb61bb70f78e1886323aa314f1f786c205c488d8b4197ad776abcb224392085 postgresql-server-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 38e687b46973f573f045c7445f2e81b0c24f79a02c729d07aa06f7ce68bb2735 postgresql-server-devel-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 5891aa5f6459f210642a7d2f234aa2bf2f8d186c3bf0c4d2f4970d27c5cb4afa postgresql-server-devel-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: e2ec713aa655c39809de45051b723f511188236b5bf2f9487b3a21fda0df3a5c postgresql-static-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 59f369b826e0ad15b9f4b236c37355b6849848794b3fc57c3d62e2e173ef06b2 postgresql-test-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 3b4227b2f3a3a6b7fae2260f7f6a071a8b77bcbd6710a1bc32dfe96447f55382 postgresql-test-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 230fc033a73c0b3c225238b93ac4f4ae24f956875c6dc24796945c841a4852bf postgresql-test-rpm-macros-15.18-1.module+el8.8.0+24395+e7b9b4b6.noarch.rpm SHA-256: 129baf9ab9fcb7cef01abdfb330ab9c080765842c97035a34c902bfa1a969174 postgresql-upgrade-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: f84543d53856c590fe39f3f31dc2e1966362dd01f195b03f1962c4382d6fe4be postgresql-upgrade-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 8ff280c32a4824c93c7467b1a724183a1d2c092f54e6ece3fdf1111cb9164407 postgresql-upgrade-devel-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: 208b9206829efbd4f9349a175fb08f725a15235535b1cc0b8a02ab3852057a3e postgresql-upgrade-devel-debuginfo-15.18-1.module+el8.8.0+24395+e7b9b4b6.x86_64.rpm SHA-256: c499ef7ebc8ebc277e186b349fda047fe38ec085947b8a2cc774de7fbf511dbd postgresql-test-rpm-macros-15.18-1.module+el8.8.0+24395+e7b9b4b6.noarch.rpm SHA-256: 129baf9ab9fcb7cef01abdfb330ab9c080765842c97035a34c902bfa1a969174 Red Hat Enterprise Linux Server - TUS 8.8 SRPM pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: 9e33379e0420596251a48bf77e077377fd05c8fa7a8ab5d47b607924e2879d60 pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: 1acc6f1d6fb8106e2e4afad7bd9d82f1ab1f91353275e1240641db1edb622d28 postgres-decoderbufs-1.9.7-1.Final.module+el8.8.0+17071+aaaceaa4.src.rpm SHA-256: c42e7b1bb1c425ebdf3a14522939d1aa6d5aafb38b5f9a94e29410a3709fadb4 postgresql-15.18-1.module+el8.8.0+24395+e7b9b4b6.src.rpm SHA-256: eaf2610712c84026158000462575853caec4529564caf6fd9c27a6b722720de8 x86_64 pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 0ca6419f733821b5d363c7ab6a483a0171ced8c73a739bfe3a0ab853fbe87e98 pg_repack-debuginfo-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: dc842e84c02bb77b52fe710633a914ec8383438a17a7d87bf7d4f8813a3cce80 pg_repack-debugsource-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64.rpm SHA-256: 1a16bd8bca182248