{"id":"ALSA-2026:69876","summary":"Important: postgresql:16 security update","details":"PostgreSQL is an advanced object-relational database management system (DBMS).  \n\nSecurity Fix(es):  \n\n  * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)\n  * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)\n  * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)\n  * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion with \"internal\" arguments (CVE-2026-14680)\n  * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)\n  * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)\n  * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)\n  * postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)\n  * postgresql: PostgreSQL: Stack buffer overflow via OUT parameter count manipulation (CVE-2026-14679)\n  * postgresql: PostgreSQL: Arbitrary code execution via type confusion in 'refint' module (CVE-2026-14671)\n  * postgresql: PostgreSQL: Arbitrary code execution via plperl tied hash heap buffer overflow (CVE-2026-14670)\n  * postgresql: PostgreSQL: Information disclosure via type confusion in ctid selectivity estimator (CVE-2026-14668)\n  * postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)\n  * postgresql: PostgreSQL: Privilege escalation via SQL injection in EXTRACT() deparse (CVE-2026-15741)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","modified":"2026-09-22T14:26:42.384940861Z","published":"2026-09-22T00:00:00Z","related":["CVE-2026-14662","CVE-2026-14664","CVE-2026-14668","CVE-2026-14669","CVE-2026-14670","CVE-2026-14671","CVE-2026-14677","CVE-2026-14679","CVE-2026-14680","CVE-2026-15741","CVE-2026-15742","CVE-2026-16239","CVE-2026-18408","CVE-2026-19385","CVE-2026-6464","CVE-2026-6471"],"references":[{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:69876"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14662"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14664"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14668"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14669"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14670"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14671"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14677"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14679"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-14680"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-15741"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-15742"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-16239"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-18408"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-19385"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-6464"},{"type":"REPORT","url":"https://access.redhat.com/security/cve/CVE-2026-6471"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515302"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515303"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515306"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515307"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515308"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515311"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515313"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515314"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515316"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515317"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515321"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515322"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515325"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515326"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515328"},{"type":"REPORT","url":"https://bugzilla.redhat.com/2515332"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-69876.html"}],"affected":[{"package":{"name":"pg_repack","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/pg_repack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.module_el8.10.0+4199+bf03c564"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"pg_repack","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/pg_repack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"pg_repack","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/pg_repack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.1-1.module_el8.10.0+4125+ceaf7d1b"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"pgaudit","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/pgaudit"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0-1.module_el8.10.0+3798+606ebb9f"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgres-decoderbufs","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgres-decoderbufs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.Final.module_el8.10.0+3798+606ebb9f"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-contrib","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-contrib"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-docs","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-docs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-plperl","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-plperl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-plpython3","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-plpython3"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-pltcl","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-pltcl"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-private-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-private-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-private-libs","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-private-libs"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-server","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-server-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-server-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-static","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-static"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-test","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-test"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-test-rpm-macros","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-test-rpm-macros"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-upgrade","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-upgrade"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}},{"package":{"name":"postgresql-upgrade-devel","ecosystem":"AlmaLinux:8","purl":"pkg:rpm/almalinux/postgresql-upgrade-devel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-1.module_el8.10.0+4286+3c445f53"}]}],"database_specific":{"source":"https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2026:69876.json"}}],"schema_version":"1.9.0"}