Red Hat Product Errata RHSA-2026:49521 - Security Advisory
Issued:
2026-08-03
Updated:
2026-08-03

RHSA-2026:49521 - Security Advisory

Synopsis

Important: postgresql security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for postgresql is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

PostgreSQL is an advanced object-relational database management system (DBMS).

Security Fix(es):

  • postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)
  • postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module (CVE-2026-6637)
  • postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)
  • postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
  • Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

  • BZ - 2477442 - CVE-2026-6477 postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory
  • BZ - 2477443 - CVE-2026-6637 postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module
  • BZ - 2477447 - CVE-2026-6478 postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison
  • BZ - 2477448 - CVE-2026-6473 postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write

Red Hat Enterprise Linux Server - Extended Life Cycle Support 7

SRPM
postgresql-9.2.24-9.el7_9.6.src.rpm SHA-256: ccda30da4d4316a3493ed6de4efbb1ad57ff000975b216e634a436e955de238c
x86_64
postgresql-9.2.24-9.el7_9.6.i686.rpm SHA-256: 4fa97a1a963d50a90f7f641d56021e49a0b3865fb8027a2c6c66ff9f334d9d65
postgresql-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 234dd272a4e7525159fad0c8cdd3438fb202301bc63a7700ca5a8524663720d3
postgresql-contrib-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: e46204399e7c7d407aac02d06807d39463902c6704902475c7ff21a35ebb5208
postgresql-debuginfo-9.2.24-9.el7_9.6.i686.rpm SHA-256: bfd5e4625675807e1373ebb20ec7c2c885b2a913f37597e56f5f0929c26c170a
postgresql-debuginfo-9.2.24-9.el7_9.6.i686.rpm SHA-256: bfd5e4625675807e1373ebb20ec7c2c885b2a913f37597e56f5f0929c26c170a
postgresql-debuginfo-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 49da5bc8f8a19e4316e9415c2e0e8ecd1c187dafb0a47dcf59e441eb1b88f6fc
postgresql-debuginfo-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 49da5bc8f8a19e4316e9415c2e0e8ecd1c187dafb0a47dcf59e441eb1b88f6fc
postgresql-devel-9.2.24-9.el7_9.6.i686.rpm SHA-256: 1c74786734e6e2d7cb02ec9c264cbb439e6eb72aee248677bb4905c75f20e88b
postgresql-devel-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 480dd2305a974524241e8558d9eb7465846e7f4f34c50ee4a28d158a4e7293f3
postgresql-docs-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 0f705e3e20f0896eee1adb774976f1d51ce4e27b376f6adc46a8b18b5b8dbdc3
postgresql-libs-9.2.24-9.el7_9.6.i686.rpm SHA-256: acbd58da26237a3688fb754fea330a076aa7f1bf2273aea5c887ff4571170e38
postgresql-libs-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: d885e332439e3b3e85ec1a00dbf8c935967a5cae77fbe0636ff03f83f7309c7d
postgresql-plperl-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: b8405f424f6733a3d722ae3479b7db2e3fc4b53ab85d0f894b6ead53dbdf1e3f
postgresql-plpython-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 6984bc2046709870823712732568fa878fad9d92a1be7fb62f9128cd975772f8
postgresql-pltcl-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 17046d79f42fee9ea78bb672e58a7ac205a4942903159201561002ea8b786318
postgresql-server-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: b2b2c794ce05d3ee6a1b248eb04ae3f82bd573b3fb61f405173afc66038622da
postgresql-static-9.2.24-9.el7_9.6.i686.rpm SHA-256: d7c93cdb9429d5ba7f85ee844a26c74ffb6bf4e392a0e4d700e68bc2f801fe88
postgresql-static-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: c8a68b2af5eeb9e99834d4995dc2c2c147341d810ce2e176c6164487d33f17e3
postgresql-test-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: f3033936a4f2a7e216a165a009d942ae14c23ecfd8f605fda475fd584ac5bb7a
postgresql-upgrade-9.2.24-9.el7_9.6.x86_64.rpm SHA-256: 776c3628dea37bd25ac638ee6a392e56a43af03da004bcce24a592b8c55f584c

Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7

SRPM
postgresql-9.2.24-9.el7_9.6.src.rpm SHA-256: ccda30da4d4316a3493ed6de4efbb1ad57ff000975b216e634a436e955de238c
s390x
postgresql-9.2.24-9.el7_9.6.s390.rpm SHA-256: 94c70b5b1362f584bb72c993eda6b3b779869938f4ca07a6fc6c128ba3f230a8
postgresql-9.2.24-9.el7_9.6.s390x.rpm SHA-256: f41710eabf9ad6321d6bce2b11605299725c1a1ecea0a60e9c204109acb4d5bb
postgresql-contrib-9.2.24-9.el7_9.6.s390x.rpm SHA-256: ef26c241f4995792eeede40962a25884ec9a0f6e3166614edd09a78241fe19c4
postgresql-debuginfo-9.2.24-9.el7_9.6.s390.rpm SHA-256: 94e402f6594dde154668c43171354914f547c1bcd55e8c55ed184454ea6256df
postgresql-debuginfo-9.2.24-9.el7_9.6.s390.rpm SHA-256: 94e402f6594dde154668c43171354914f547c1bcd55e8c55ed184454ea6256df
postgresql-debuginfo-9.2.24-9.el7_9.6.s390x.rpm SHA-256: c28ee1f0ca23b6a7ce2833309580537a7f695683cab64f60b20374fc75fa4071
postgresql-debuginfo-9.2.24-9.el7_9.6.s390x.rpm SHA-256: c28ee1f0ca23b6a7ce2833309580537a7f695683cab64f60b20374fc75fa4071
postgresql-devel-9.2.24-9.el7_9.6.s390.rpm SHA-256: 68e0d2b4df6e9f99c6a346c5491096dddc95eab9132ee3ad64bac890a6aedbb8
postgresql-devel-9.2.24-9.el7_9.6.s390x.rpm SHA-256: aaf4a5dceba5e63783db6cba8252a666b4c9ca65ccdef1e5bdda94703396c4cf
postgresql-docs-9.2.24-9.el7_9.6.s390x.rpm SHA-256: e778adad4f7017a2dad15036a109bca4a530a145f5c6676c5301a93930615f97
postgresql-libs-9.2.24-9.el7_9.6.s390.rpm SHA-256: 80a8d23e15e0dd10a74f8926f8468eb2ac224936b2b7c0de7f08e3217057dd6b
postgresql-libs-9.2.24-9.el7_9.6.s390x.rpm SHA-256: bf4ee415528c165173ddba1de3a5f8f618753e6cb35142a0552064dbf2cfc43e
postgresql-plperl-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 2d67eaec94a2aac6dbda1f351bf5d7a475b7465baf0f216384a6c163683469db
postgresql-plpython-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 42c0aed361dff5035369be2639a3598d68db7ae01c754af9bf16f5a689b11f56
postgresql-pltcl-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 4e09919f0b84fd9b1952716b28b4471883347c5e51f843431961cec9243bc85b
postgresql-server-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 20cf25ceac8284f0582a4fd5f6c5410109134ad5a0715f0f7049a4c446368219
postgresql-static-9.2.24-9.el7_9.6.s390.rpm SHA-256: f7aace06a512f571876911306190239616f345efd5f546ed47c6846217b9b36e
postgresql-static-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 59be3d26b0f7d0701f34c10ee8d58c91cbf646277b3484dfffa13eae1ee530bd
postgresql-test-9.2.24-9.el7_9.6.s390x.rpm SHA-256: dff75024d410bb39928eea046ea62d7c62e2b2f2879195e36b181ce5c194dde3
postgresql-upgrade-9.2.24-9.el7_9.6.s390x.rpm SHA-256: 68e5d6b0e59c37acf9a84931fd76872e72baf4ebbfe0c824af8975fab0ec601c

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7

SRPM
postgresql-9.2.24-9.el7_9.6.src.rpm SHA-256: ccda30da4d4316a3493ed6de4efbb1ad57ff000975b216e634a436e955de238c
ppc64
postgresql-9.2.24-9.el7_9.6.ppc.rpm SHA-256: c3723eb97aee3e9c938c619380413c5f5c374aaa4de3d2c1f5f0ffc4ffc7f7f7
postgresql-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: fc429322dfff47ae0745dc1848a31761fb046c26cbe805441dca5a8a453f358a
postgresql-contrib-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 322a01f4c2e61eba9fea468c8f4d57a4cb65bb96bd8e68987f14eaeaed5f0506
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc.rpm SHA-256: c4e9d5ed48cf5de06008ff5cc49d74cfde899e9c53126a64a5f6f8af30188000
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc.rpm SHA-256: c4e9d5ed48cf5de06008ff5cc49d74cfde899e9c53126a64a5f6f8af30188000
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 6a47dd228796737db8e8c15f057315e6f2d73ce7da8017f045f31a2a23f2260a
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 6a47dd228796737db8e8c15f057315e6f2d73ce7da8017f045f31a2a23f2260a
postgresql-devel-9.2.24-9.el7_9.6.ppc.rpm SHA-256: 3e02809de20962b89c3b4bcc1e6fffd0ffff70121f8bd3c676d3197496cbd020
postgresql-devel-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: ed64c1db8e45a8586b4bbd55fa9a030ce30b1a24f82cedb865c0e83dccb709db
postgresql-docs-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 1c80451eddfda7f0f19f68dfaf1b8133b371f55035136014cd692017d979363d
postgresql-libs-9.2.24-9.el7_9.6.ppc.rpm SHA-256: f927f2953f1cf5ceffd60cf65b3aed027d66275d1e18b27f8b9f1e4a466919aa
postgresql-libs-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: a908db669d7c69248a22df9fe561a672a9bc0abb06c870dc0dad1eb225dbe76b
postgresql-plperl-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 0dd452609a38e8e2e46cd1829d7ef727dd8923e0d5972e50cabaa2bbead9b317
postgresql-plpython-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 7c9d73a99848eafd4ca41cbdbd8248917dd5d95f8ce3edd0d535d62ddab9b5ba
postgresql-pltcl-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 8e85676863d6d74263253439384944ae33524d44cf7e804b96baeb09439556fb
postgresql-server-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 2f4d29ce0610f67a2fce941eb8b9c9e35e25cd41bcc67d447a92903d83b0f204
postgresql-static-9.2.24-9.el7_9.6.ppc.rpm SHA-256: 3087faa703b9e546b32acf59851801f4e4eac252fef3168fa29827ba7ab40597
postgresql-static-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 06b15cb9530825f6bb78492ca7cfb272d413ba32b857371401b12bb3768346f8
postgresql-test-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: 753fc9d92d20cb8aff08cdabb5f6e90f90a14e56f07f411939757e45c2cdc151
postgresql-upgrade-9.2.24-9.el7_9.6.ppc64.rpm SHA-256: efd96f31dd5952b392c9cf13c4d5b8cac47e0e574d9371fe21ecfa9c64fa21fb

Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7

SRPM
postgresql-9.2.24-9.el7_9.6.src.rpm SHA-256: ccda30da4d4316a3493ed6de4efbb1ad57ff000975b216e634a436e955de238c
ppc64le
postgresql-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: ebe07bc0b2ae3644c2f03bd7bd9d50caa8735622738abc926b14372150fd1c2e
postgresql-contrib-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 1e73a39dc7057f83dfd89b73342bcfb257ada37b02f90b5e4467050c763bfe0f
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 706b75168ac3b99e50f65f3d6180e72c56f17136db06809e705a9550c4a00792
postgresql-debuginfo-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 706b75168ac3b99e50f65f3d6180e72c56f17136db06809e705a9550c4a00792
postgresql-devel-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 26d36e235d88a6d2d05c54c0d39417b9fd82d8e5e70021dc95da8787cae3ad3a
postgresql-docs-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 03602d57ca31431e4fde8f1d305bf07fe43d25fe1b1eaa14f1f03381bcb367d4
postgresql-libs-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: f01f3423286ddedc71199bcd31bcb3f925c0d938598a1a4538b283a7fe419030
postgresql-plperl-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 2961d8851b89497ab583ff95b143bd3025edd5f318d84080b1c1d7202fb80033
postgresql-plpython-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 87afb6a11f9df32273c630eaa98e094606d5f6341dad142b4223fe8482aa4091
postgresql-pltcl-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: d263fe4cf18ca1e211d6fec2d7ee089f341cca409e5ecb439672038fe714e38f
postgresql-server-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: facbe0cddb3657c29e9252b3f2f02ff1afaebc14aa00d6df4106d07e74cfc2d7
postgresql-static-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 03d0de3a77aa22be9dcc293cd68be8a8a8bd021a87c11f92b3c43f1bcd025809
postgresql-test-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: e86c62dd6cff2e43658d28391f6e99d04195d7938fd8587c6d8333b273d5bdb8
postgresql-upgrade-9.2.24-9.el7_9.6.ppc64le.rpm SHA-256: 624f8659f7ac59a3027d64fd16603fb5f3ed2bce9ff879e6c199d02b1c2343b5

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.