This advisory addresses four vulnerabilities in PostgreSQL 13, including a high-severity (CVSS 8.8) symlink-following flaw in pg_basebackup and pg_rewind allowing OS account hijack (CVE-2026-6475), a high-severity (CVSS 8.8) buffer overflow in libpq enabling a server superuser to overwrite client stack memory (CVE-2026-6477), a medium-severity (CVSS 6.5) credential recovery via a timing channel in MD5 password comparison (CVE-2026-6478), and an integer overflow leading to an out-of-bounds write (CVE-2026-6473). The NVD data indicates these vulnerabilities affect PostgreSQL versions prior to 14.23, 15.0 through 15.18, 16.0 through 16.14, 17.0 through 17.10, and 18.0 through 18.4, with fixes available in versions 14.23, 15.18, 16.14, 17.10, and 18.4 respectively. The Red Hat update provides the necessary patches for the PostgreSQL 13 module on specific RHEL 8.8 Extended Life Cycle and Update Service channels.
Red Hat Product Errata RHSA-2026:42555 - Security Advisory Issued: 2026-07-21 Updated: 2026-07-21 RHSA-2026:42555 - Security Advisory Overview Updated Packages Synopsis Important: postgresql:13 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the postgresql:13 module is now available for Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Red Hat Enterprise Linux 8.8 Telecommunications Update Service. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 x86_64 Red Hat Enterprise Linux Server - TUS 8.8 x86_64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64 Fixes BZ - 2477439 - CVE-2026-6475 postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write CVEs CVE-2026-6473 CVE-2026-6475 CVE-2026-6477 CVE-2026-6478 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 - Extended Life Cycle Long Life 8.8 SRPM pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src.rpm SHA-256: cf5bb68a93506815947a641a4bae89bc8fc115702e717c450fc3e37a54ad3976 pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src.rpm SHA-256: 69d37c6427f18ed1bd6d29cb2f54e083fb125c162fcb59a687c67528a2fb08e9 postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src.rpm SHA-256: 1afa4d664011737a91d8efe7f3ba1f1f9bd6c8e7c510d867bbd1ff41832fe95a postgresql-13.23-1.module+el8.8.0+24513+386abafd.2.src.rpm SHA-256: cbea6e6b7ac69ad5748efcd24837704205ba34ca0100a0e0d48d9aba2c6f212f x86_64 pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: ca85a22006bcc34f5c248b316e7cd4f4e85dd9b567d2c981f74d379062c844b4 pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: 557512e3ee00e5a6d5ff46d4443efd853f36d6030c9ed8776c0915d29d081f60 pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: ab85bdfa7d6d9b2e50f316880881239ce99e0915979a65b144349b95b844fa6b pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: 0ee2cdf7b40988a40a70294764149d58ef44f12b69ac85752465444a5b011340 pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: ed444ce541962f85a37cae58466a203788f69a184d7dbeec159d7b424ab0ff8c pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: 3092f6f3bd32f8b30489fed2aad9d9884f77da6872a53d6b183a49b0224e7d91 postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: c2d5f6f1d41fd29098090d75b4927696fc01450d42ae75311c14056e574645c0 postgres-decoderbufs-debuginfo-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: 7275a1229edefdcf0df138ea35e317fb9143461c6122cb4c8a3ec2821f5e1b65 postgres-decoderbufs-debugsource-0.10.0-2.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: c7145f0c47def50c037cd2694d408fa03627e7581a1303e8d7ccfb5cf47918e6 postgresql-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: b8debe6016b512d456da902a0b0cc62f4d43eda91d5ae2744f03ceb6186c44b6 postgresql-contrib-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: aa054af582ee4a0741f9ef49eefdd3d3ebb159159c4a759424002f9c1b0efa34 postgresql-contrib-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 82712bd97ca29179ccd3d553a055003b872994f40bec7b7a3d2f1850297adc8b postgresql-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: c0c87c7feccd46a55b721d6e05337c139ac98272de2c85e4e6952fc9c14f254c postgresql-debugsource-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: ea2a081ec42d1685267b09a087fe7c68342bbd8aafe5da3e840fc71ca298b6ee postgresql-docs-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 151a1a6e00519589667aa0eab78a90dfac35e28882261427398b2ca039281b61 postgresql-docs-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: a9a1bfb89dac55426989d2d9e2c4795b1f54aab544bc7afbfc404f215258bca7 postgresql-plperl-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 23b38fccfd723fd4a47a1e4eb2e7616e259993c2cabbd93eb90b86fabf5fccf7 postgresql-plperl-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 4c21371004870495889bd568102745dee00a8fdc8562c78bf23a3016f4cf7bca postgresql-plpython3-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: c1ae36711bb3ccf7e59113ece969c78c3e4f9e87f6a55e21bb506f481dce6098 postgresql-plpython3-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 4ec372c64f9b2851832f89550d368b3ab37fc40969f852535aa59c8d2f7855f5 postgresql-pltcl-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 6c6c70fdc82cbd6b3d95a47663a636af37d89091831b256f6b09e3af8ba6c563 postgresql-pltcl-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 5bb6ba73846952d7fefd7767f97fb6f7fb6858628cf1dbc9e2a0e8ed12e6feb2 postgresql-server-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 9105c6400e87937f4604867b505dc26bdc18349ea7878df28703977e1e434d34 postgresql-server-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 42c58edeb4d9bfb0cdb102c71ac5f25d3779e085623ded240bdbf55aaae8db36 postgresql-server-devel-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: fec32bed5c727a3cfb15c43c6fe776404fb41857cdf1ded4d75fefb296dfbf96 postgresql-server-devel-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 34cf745e89d832c072137fd722cf0883085351c565769ec8472d10aa0f79a45d postgresql-static-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 7fc7963bdd7a919e7a3c91ccbb5343ccf5c4efd102e07389af506b377d60e62f postgresql-test-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 2692186ff0f63fba1924ccb1dc39d2ff305de095d38753a19ffc4c26f8e6e594 postgresql-test-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: dae536ba134676bbbf9cc489df6b649e0da49cee648ee2fcf969c146330550f0 postgresql-test-rpm-macros-13.23-1.module+el8.8.0+24513+386abafd.2.noarch.rpm SHA-256: 1a3a31cce36663c6bcdef92859d19878aba0b702a20789610c35b68e319c513a postgresql-upgrade-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: e62267aaf8439b78524b01dfd84926f1deefb636057d4e25e8614963a2464b94 postgresql-upgrade-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: a715736aefdc5d4bbacb7c94ec034a36bda9fb4b4571ca539b54f7a383cd7653 postgresql-upgrade-devel-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: 70049e4e576bfee9fbbd994456f9a4c69844edb1d468cdef57698a2cad2999a9 postgresql-upgrade-devel-debuginfo-13.23-1.module+el8.8.0+24513+386abafd.2.x86_64.rpm SHA-256: b44fb486e32a925bd09df1c4c184d0ce8519c9bf65d635d1f4ed59c0395bab40 postgresql-test-rpm-macros-13.23-1.module+el8.8.0+24513+386abafd.2.noarch.rpm SHA-256: 1a3a31cce36663c6bcdef92859d19878aba0b702a20789610c35b68e319c513a Red Hat Enterprise Linux Server - TUS 8.8 SRPM pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src.rpm SHA-256: cf5bb68a93506815947a641a4bae89bc8fc115702e717c450fc3e37a54ad3976 pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src.rpm SHA-256: 69d37c6427f18ed1bd6d29cb2f54e083fb125c162fcb59a687c67528a2fb08e9 postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src.rpm SHA-256: 1afa4d664011737a91d8efe7f3ba1f1f9bd6c8e7c510d867bbd1ff41832fe95a postgresql-13.23-1.module+el8.8.0+24513+386abafd.2.src.rpm SHA-256: cbea6e6b7ac69ad5748efcd24837704205ba34ca0100a0e0d48d9aba2c6f212f x86_64 pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: ca85a22006bcc34f5c248b316e7cd4f4e85dd9b567d2c981f74d379062c844b4 pg_repack-debuginfo-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: 557512e3ee00e5a6d5ff46d4443efd853f36d6030c9ed8776c0915d29d081f60 pg_repack-debugsource-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64.rpm SHA-256: ab85bdfa7d6d9b2e50f316880881239ce99e0915979a65b144349b95b844fa6b pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: 0ee2cdf7b40988a40a70294764149d58ef44f12b69ac85752465444a5b011340 pgaudit-debuginfo-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: ed444ce541962f85a37cae58466a203788f69a184d7dbeec159d7b424ab0ff8c pgaudit-debugsource-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64.rpm SHA-256: 3092f6f3bd32f8b30489fed2aad9d9884f77da6872a