Red Hat Product Errata RHSA-2026:27718 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:27718 - Security Advisory Overview Updated Packages Synopsis Important: postgresql16 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for postgresql16 is now available for Red Hat Enterprise Linux 10.0 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support 10.0 x86_64 Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support 10.0 ppc64le Red Hat CodeReady Linux Builder for IBM z Systems - Extended Update Support 10.0 s390x Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support 10.0 aarch64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64 Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 SRPM postgresql16-16.14-1.el10_0.src.rpm SHA-256: ff66671065add4450add8dc66129a4a7fef11fb182a9e4e5b096d25c2aa38b00 x86_64 postgresql-16.14-1.el10_0.x86_64.rpm SHA-256: 8c7168228851e5c40ce07daaf3385c0b891193af30a14f7a917bf413489cd34d postgresql-contrib-16.14-1.el10_0.x86_64.rpm SHA-256: a736e219e4b034cac92fbd373724846d9497c59ab5ee176711304ec21267bfa2 postgresql-contrib-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 176abfe253b8f0c965a1e8a7ac320c038e9d8b6d3a2bae63689bbd500ea137ab postgresql-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: cf200cd33ee71ddcb4df72b18912d416c8c2b1e35366a5b67bce7038454c7548 postgresql-docs-16.14-1.el10_0.x86_64.rpm SHA-256: 2f77d45a631e4a4dc4845cf99b22c582871d6bad58ae154c9f3b43ed855adb9e postgresql-docs-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 8ffdcf398ac22199f91d293be0e2ed50d2f6f86097e1ce25ba296b818e87c2ca postgresql-plperl-16.14-1.el10_0.x86_64.rpm SHA-256: 94302fd20bb5f012bb7b42877f7c065fd1e07ed7ec5b77335f8f7135918d4af7 postgresql-plperl-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 93632cd1a268b762ea62af67da6992b39c8419176509542d694280630f34c18d postgresql-plpython3-16.14-1.el10_0.x86_64.rpm SHA-256: c66e44da42194c11cc90e7a837a561d77ecffb8bc4014c549526b33e9e83a2db postgresql-plpython3-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 73d75dd0a028a52dddf26af42278afe9ab631421886a7a83f18dccfa0ec271ef postgresql-pltcl-16.14-1.el10_0.x86_64.rpm SHA-256: 756615e68c3306671f11caad1397490315a537d338a8f5b913b01f9617f91b11 postgresql-pltcl-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 8b2093753eaa5b5f2b8918daecc978a8100b6e489e86a2f525319d0d85663abc postgresql-private-devel-16.14-1.el10_0.x86_64.rpm SHA-256: 54cb67fc1f5bfa3bdfe5529f9648f2d72b5e36b9b1a22a209fddeca5568d5e82 postgresql-private-libs-16.14-1.el10_0.x86_64.rpm SHA-256: 7fcfdeca62c05f2faa81bfd4d85d0dfd1c1c2d8e1a92bfe551e095c319148906 postgresql-private-libs-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 943e20771eba65af65a5e9a191bb456745dac797689ff8d4570f6efcc9e032a0 postgresql-server-16.14-1.el10_0.x86_64.rpm SHA-256: 73b1e37031b7cd00021b3c68aa8857369f48f6e770a280e4fb9fc225530c8ae2 postgresql-server-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: d2757e0c29142aee33fa6a34293094b6d4635d465e3ba4dea66adc24e74e4919 postgresql-server-devel-16.14-1.el10_0.x86_64.rpm SHA-256: 7a0f7c1fdeedb2efa5a05201cef2548246be257c3d9ca690e422ef6752256bd5 postgresql-server-devel-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 452707cee552891c04f680d326117658edf553cb71c8890312e7b3a1eca8f416 postgresql-static-16.14-1.el10_0.x86_64.rpm SHA-256: ad5fffb1c6aad21b40c6b9d178e1b5d1fbc3a7e6cd68e5521856e2c574e4b21e postgresql-test-16.14-1.el10_0.x86_64.rpm SHA-256: 5935526bdc552ec0f4d03a0ecd050daa61be8c7fa8a89564872b11d7b00bbe1a postgresql-test-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: f3fea766a3706eb1acd34f0e4b0e7b3549b4a9ed4dbe23a67415a2694dde9af5 postgresql-upgrade-16.14-1.el10_0.x86_64.rpm SHA-256: ca8a6b03c72cd81ab3700978a7b68d3d7aadee1fb1b47e4b6dc18d21d6867b50 postgresql-upgrade-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 8f6060d1f83632d706da30c52ccbed437e9b9afacde468ae71aa243159febe50 postgresql-upgrade-devel-16.14-1.el10_0.x86_64.rpm SHA-256: 78e9b0390790dd893dc0beb043ebd7bbceddebf27cc1eaba1d44bec3aeb3da4f postgresql-upgrade-devel-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 6007bebea79889f68cd099be1bd340f6a6c04fde38d3ad66f7d8659b96eddc64 postgresql16-debuginfo-16.14-1.el10_0.x86_64.rpm SHA-256: 28e40f83d6c19ec5063555ecf761435b80e1c8ca750916475c0e9942480d029c postgresql16-debugsource-16.14-1.el10_0.x86_64.rpm SHA-256: 260d1d6a42ed5cf865e1e8a9101edf907d2a3b094aa8d325748b844378eea055 Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 SRPM postgresql16-16.14-1.el10_0.src.rpm SHA-256: ff66671065add4450add8dc66129a4a7fef11fb182a9e4e5b096d25c2aa38b00 s390x postgresql-16.14-1.el10_0.s390x.rpm SHA-256: 5f2df6e47b30e3028f94ab08c187c08f2dd068d264f09176868af978dda7bdd2 postgresql-contrib-16.14-1.el10_0.s390x.rpm SHA-256: e9cc96d13bf0221ff3083f35c5a41194091856d9c2b79be6eda55e5df28ec676 postgresql-contrib-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: f48c060a8bd6de481adcb78fd418b3a800f909e8c71de6f0664fc0278335ebfa postgresql-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 19fa323c06115ef197e5508add7c2d1dba1045ad76c580498ece085cf8ac5fb0 postgresql-docs-16.14-1.el10_0.s390x.rpm SHA-256: 3ee3eac2acd6d2a9dd3061c0d3545a454b89c81696e0358cbebd73f63c9b3696 postgresql-docs-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 7d153fee66d4fa17e00de50b730194daa8d96c1ad3431ce72e0a51c6d87605b8 postgresql-plperl-16.14-1.el10_0.s390x.rpm SHA-256: a8103b33ec8bcbc79c1bb2e0f08ee83b2480a5bdf135a5224a474319b8af229b postgresql-plperl-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 76da9a18989ac9e37f1d9aebbdaa082b7c139ca87ed92914f19c5c11a15e2e36 postgresql-plpython3-16.14-1.el10_0.s390x.rpm SHA-256: 37d41e4f9160bb8261920fdce8360913518c66a0dd97bab7a7f28f8d3df30cfa postgresql-plpython3-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 6c2457bb5ad6761ef202c04d7c92f0fee02af57ee8b738f8bdcb628e442e3afd postgresql-pltcl-16.14-1.el10_0.s390x.rpm SHA-256: 709ec4bad5ec3bc498e9f6cc063eb98ea1bbc597178ebd29c8b39f954c7f5c5b postgresql-pltcl-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: cc08202d271fd58d916b934cbbdb30b0baa9d57edf8bca778c715e25be9e1f35 postgresql-private-devel-16.14-1.el10_0.s390x.rpm SHA-256: 972cd7bd371dd03ffad55a8562822d5b883d1c8d31cdab59a44e6863bf786ac6 postgresql-private-libs-16.14-1.el10_0.s390x.rpm SHA-256: c57a42c880a480bba1e751f94adf40c3d27f07d76580997ee5f2e13271d24d95 postgresql-private-libs-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: b7f134f67dab88ed102f91063b32b65f691fbb1e655b5c29cac7d9e125733b3d postgresql-server-16.14-1.el10_0.s390x.rpm SHA-256: 3821366c0adda79fe4080190c85825559d45279d8c6dda5ed3f02b5697b5b18e postgresql-server-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 3694687aa41e65aae4348af5201c73005afa3509712924ab8b6d08a62b7bc9c0 postgresql-server-devel-16.14-1.el10_0.s390x.rpm SHA-256: 254f2e1212b6455a26b6c4d50fafb42843fc1356c258c010b6a424ae837d796a postgresql-server-devel-debuginfo-16.14-1.el10_0.s390x.rpm SHA-256: 1a5ad93d2cf53fa0524082d9aa4d6c174bc76e38a4a6c55dc9612deade53cf00 postgre