Red Hat Product Errata RHSA-2026:27738 - Security Advisory Issued: 2026-06-22 Updated: 2026-06-22 RHSA-2026:27738 - Security Advisory Overview Updated Packages Synopsis Important: libpq security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for libpq is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 8 x86_64 Red Hat Enterprise Linux for IBM z Systems 8 s390x Red Hat Enterprise Linux for Power, little endian 8 ppc64le Red Hat Enterprise Linux for ARM 64 8 aarch64 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 s390x Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 8 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e x86_64 libpq-13.23-2.el8_10.i686.rpm SHA-256: de134457ccfec5270beb7566be7ea6550df14810157891bb696bc0ccd90db6a8 libpq-13.23-2.el8_10.x86_64.rpm SHA-256: 46fe923e1b420a7e13b0e7239749ea8519ace692759139c1a78e4c8ec2912c82 libpq-debuginfo-13.23-2.el8_10.i686.rpm SHA-256: d4d45e2f279a928ec168b3c5db1e8981efe4c6914106399177de09545cd480c3 libpq-debuginfo-13.23-2.el8_10.x86_64.rpm SHA-256: 08cb38ff409c689798c69cdb4198e92bd818f365a32c7b136453821f559d7e0c libpq-debugsource-13.23-2.el8_10.i686.rpm SHA-256: e673556739310b14d16d6cf1c73b70cd3a0a4c6c2687001417b29ffea80e5fdb libpq-debugsource-13.23-2.el8_10.x86_64.rpm SHA-256: 1e8e02cbbadd68c1bf151f8d801185557e4c6ae0089c2da4b6ef07fb1e049564 libpq-devel-13.23-2.el8_10.i686.rpm SHA-256: aee536a18f236d67e3f4184492d29fb83643218bf3a2d75cf5cb4c7022642e3e libpq-devel-13.23-2.el8_10.x86_64.rpm SHA-256: 3a957c2640a2fb4248c89ab0a2ca84061ae588be3ab0446ee8a5edf65def5c4f libpq-devel-debuginfo-13.23-2.el8_10.i686.rpm SHA-256: 7ab36342e45e1210c84f1ce3900b9e4420b246480ae3d587edcc40419e41c27c libpq-devel-debuginfo-13.23-2.el8_10.x86_64.rpm SHA-256: a6923b21cf210d2739ff4a43608d28fe11e5f3476a3ae38d290593e98cc3a4b9 Red Hat Enterprise Linux for IBM z Systems 8 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e s390x libpq-13.23-2.el8_10.s390x.rpm SHA-256: 855555d8ba4a2ee526e3cb3916707968ff42cebd45481708a16583896014e537 libpq-debuginfo-13.23-2.el8_10.s390x.rpm SHA-256: 2c8c1fcf6c570ea98b22daf49c84da95756a4275f41080347b312f338c9fa803 libpq-debugsource-13.23-2.el8_10.s390x.rpm SHA-256: 40a20306da4a352d91d0d78b863d8f4976edd7c77a9143352de50d2787f4c9ab libpq-devel-13.23-2.el8_10.s390x.rpm SHA-256: 2acf1b69903a988da17474289f0c1952378bdc1f1338ba21fc46bb57bfabde8c libpq-devel-debuginfo-13.23-2.el8_10.s390x.rpm SHA-256: 8c165194a9bd70817def5b29449b5c28b0efbb24b23b97bfea6f1fb005af7e79 Red Hat Enterprise Linux for Power, little endian 8 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e ppc64le libpq-13.23-2.el8_10.ppc64le.rpm SHA-256: 0293253414eb4e78faf17322bc4790672a858ece5de5e3a2ae928b8c2832b6ac libpq-debuginfo-13.23-2.el8_10.ppc64le.rpm SHA-256: 6b1d13dd70d9fbc74b5c12932e36b5894255ebe60ae01952aaf8af9aa41b6802 libpq-debugsource-13.23-2.el8_10.ppc64le.rpm SHA-256: 59a73dad0fc8fa2464bdbe311373093d3d787e7f11e1a4ca3777cde9232c15ad libpq-devel-13.23-2.el8_10.ppc64le.rpm SHA-256: 41764c87983c2960459b4041ca0d072f3336f3e42c8652d62c77a3b0a5751dd5 libpq-devel-debuginfo-13.23-2.el8_10.ppc64le.rpm SHA-256: 8e2aed9986a0d32e78acb2973e7485b95e54ff10b2932ffe2014db96d106aad7 Red Hat Enterprise Linux for ARM 64 8 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e aarch64 libpq-13.23-2.el8_10.aarch64.rpm SHA-256: 79d81f44f09a5066a62e661d848ba10d8c4faeb50b18efb7d0b067a39402030d libpq-debuginfo-13.23-2.el8_10.aarch64.rpm SHA-256: 15eab760be43359d5ab575fd5091526d2af26e105d166e6c80a77f9ba8bbb4fd libpq-debugsource-13.23-2.el8_10.aarch64.rpm SHA-256: 5619038da28361d6dac3ef2329246bfe65d30274f6898ea2ac8abed1fc749e9b libpq-devel-13.23-2.el8_10.aarch64.rpm SHA-256: ddec57ef230774c368523f75c2ff743b89ccfaf6e985a185864c56230c729f16 libpq-devel-debuginfo-13.23-2.el8_10.aarch64.rpm SHA-256: c2e6efb85043068ed6adf717bbc783cf48f3eb6822f228eda54730877e00e297 Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 8.10 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e x86_64 libpq-13.23-2.el8_10.i686.rpm SHA-256: de134457ccfec5270beb7566be7ea6550df14810157891bb696bc0ccd90db6a8 libpq-13.23-2.el8_10.x86_64.rpm SHA-256: 46fe923e1b420a7e13b0e7239749ea8519ace692759139c1a78e4c8ec2912c82 libpq-debuginfo-13.23-2.el8_10.i686.rpm SHA-256: d4d45e2f279a928ec168b3c5db1e8981efe4c6914106399177de09545cd480c3 libpq-debuginfo-13.23-2.el8_10.x86_64.rpm SHA-256: 08cb38ff409c689798c69cdb4198e92bd818f365a32c7b136453821f559d7e0c libpq-debugsource-13.23-2.el8_10.i686.rpm SHA-256: e673556739310b14d16d6cf1c73b70cd3a0a4c6c2687001417b29ffea80e5fdb libpq-debugsource-13.23-2.el8_10.x86_64.rpm SHA-256: 1e8e02cbbadd68c1bf151f8d801185557e4c6ae0089c2da4b6ef07fb1e049564 libpq-devel-13.23-2.el8_10.i686.rpm SHA-256: aee536a18f236d67e3f4184492d29fb83643218bf3a2d75cf5cb4c7022642e3e libpq-devel-13.23-2.el8_10.x86_64.rpm SHA-256: 3a957c2640a2fb4248c89ab0a2ca84061ae588be3ab0446ee8a5edf65def5c4f libpq-devel-debuginfo-13.23-2.el8_10.i686.rpm SHA-256: 7ab36342e45e1210c84f1ce3900b9e4420b246480ae3d587edcc40419e41c27c libpq-devel-debuginfo-13.23-2.el8_10.x86_64.rpm SHA-256: a6923b21cf210d2739ff4a43608d28fe11e5f3476a3ae38d290593e98cc3a4b9 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 8.10 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e aarch64 libpq-13.23-2.el8_10.aarch64.rpm SHA-256: 79d81f44f09a5066a62e661d848ba10d8c4faeb50b18efb7d0b067a39402030d libpq-debuginfo-13.23-2.el8_10.aarch64.rpm SHA-256: 15eab760be43359d5ab575fd5091526d2af26e105d166e6c80a77f9ba8bbb4fd libpq-debugsource-13.23-2.el8_10.aarch64.rpm SHA-256: 5619038da28361d6dac3ef2329246bfe65d30274f6898ea2ac8abed1fc749e9b libpq-devel-13.23-2.el8_10.aarch64.rpm SHA-256: ddec57ef230774c368523f75c2ff743b89ccfaf6e985a185864c56230c729f16 libpq-devel-debuginfo-13.23-2.el8_10.aarch64.rpm SHA-256: c2e6efb85043068ed6adf717bbc783cf48f3eb6822f228eda54730877e00e297 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 8.10 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e ppc64le libpq-13.23-2.el8_10.ppc64le.rpm SHA-256: 0293253414eb4e78faf17322bc4790672a858ece5de5e3a2ae928b8c2832b6ac libpq-debuginfo-13.23-2.el8_10.ppc64le.rpm SHA-256: 6b1d13dd70d9fbc74b5c12932e36b5894255ebe60ae01952aaf8af9aa41b6802 libpq-debugsource-13.23-2.el8_10.ppc64le.rpm SHA-256: 59a73dad0fc8fa2464bdbe311373093d3d787e7f11e1a4ca3777cde9232c15ad libpq-devel-13.23-2.el8_10.ppc64le.rpm SHA-256: 41764c87983c2960459b4041ca0d072f3336f3e42c8652d62c77a3b0a5751dd5 libpq-devel-debuginfo-13.23-2.el8_10.ppc64le.rpm SHA-256: 8e2aed9986a0d32e78acb2973e7485b95e54ff10b2932ffe2014db96d106aad7 Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 8.10 SRPM libpq-13.23-2.el8_10.src.rpm SHA-256: b982ca61245da11ecfc22635f8bd658ec2cb710bcd9d17f11579b1bf7dfad41e s390x libpq-13.23-2.el8_10.s390x.rpm SHA-256: 855555d8ba4a2ee526e3cb3916707968ff42cebd45481708a16583896014e537 libpq-debuginfo-13.23-2.el8_10.s390x.rpm SHA-256: 2c8c1fcf6c570ea98b22daf49c84da95756a4275f41080347b312f338c9fa803 libpq-debugsource-13.23-2.el8_10.s390x.rpm SHA-256: 40a20306da4a352d91d0d78b863d8f4976edd7c77a9143352de50d2787f4c9ab libpq-devel-13.23-2.el8_10.s390x.rpm SHA-256: 2acf1b69903a988da17474289f0c1952378bdc1f1338ba21fc46bb57bfabde8c libpq-devel-debuginfo-13.23-2.el8_10.s390x.rpm SHA-256: 8c165194a9bd7081