Red Hat Security Advisory: postgresql:15 security update
Multiple arbitrary code execution vulnerabilities have been identified in PostgreSQL, affecting various functions and plugins including tsvector, tsquery, logical decoding plugin, regexp, pltcl, plperl, fuzzystrmatch, cursor lifecycle, POSIX timezone abbreviation, and pg_dump transform lists. These vulnerabilities are addressed in a security update released by Red Hat for PostgreSQL 15 and related versions. The update is rated as important by Red Hat Product Security and fixes several critical issues that could allow attackers to execute arbitrary code.
AI Analysis
Technical Summary
Red Hat has issued a security advisory for PostgreSQL 15 and related versions addressing multiple arbitrary code execution vulnerabilities. These include integer wraparound issues in tsvector and tsquery functions (CVE-2026-14662), logical decoding plugin (CVE-2026-6471), type confusion with internal arguments (CVE-2026-14680), heap buffer overflow in regexp (CVE-2026-14664), arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677), integer wraparound in fuzzystrmatch (CVE-2026-15742), type confusion in cursor lifecycle (CVE-2026-16239), long POSIX timezone abbreviation (CVE-2026-14669), and crafted transform lists in pg_dump (CVE-2026-19385). These vulnerabilities allow for arbitrary code execution and are fixed in the updated packages provided by Red Hat.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of the PostgreSQL server process. This could lead to full compromise of the database server, potentially affecting data confidentiality, integrity, and availability. The advisory rates the security impact as important, indicating a high severity level for these issues.
Mitigation Recommendations
Red Hat has released security updates that fix these vulnerabilities. Users are advised to apply the updated PostgreSQL packages as provided in the Red Hat advisory RHSA-2026:69698. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since a patch is available, applying the official fix is the recommended mitigation.
Red Hat Security Advisory: postgresql:15 security update
Description
Multiple arbitrary code execution vulnerabilities have been identified in PostgreSQL, affecting various functions and plugins including tsvector, tsquery, logical decoding plugin, regexp, pltcl, plperl, fuzzystrmatch, cursor lifecycle, POSIX timezone abbreviation, and pg_dump transform lists. These vulnerabilities are addressed in a security update released by Red Hat for PostgreSQL 15 and related versions. The update is rated as important by Red Hat Product Security and fixes several critical issues that could allow attackers to execute arbitrary code.
Affected software
pkg:deb/postgresql/postgresqlRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat has issued a security advisory for PostgreSQL 15 and related versions addressing multiple arbitrary code execution vulnerabilities. These include integer wraparound issues in tsvector and tsquery functions (CVE-2026-14662), logical decoding plugin (CVE-2026-6471), type confusion with internal arguments (CVE-2026-14680), heap buffer overflow in regexp (CVE-2026-14664), arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677), integer wraparound in fuzzystrmatch (CVE-2026-15742), type confusion in cursor lifecycle (CVE-2026-16239), long POSIX timezone abbreviation (CVE-2026-14669), and crafted transform lists in pg_dump (CVE-2026-19385). These vulnerabilities allow for arbitrary code execution and are fixed in the updated packages provided by Red Hat.
Potential Impact
Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code within the context of the PostgreSQL server process. This could lead to full compromise of the database server, potentially affecting data confidentiality, integrity, and availability. The advisory rates the security impact as important, indicating a high severity level for these issues.
Mitigation Recommendations
Red Hat has released security updates that fix these vulnerabilities. Users are advised to apply the updated PostgreSQL packages as provided in the Red Hat advisory RHSA-2026:69698. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since a patch is available, applying the official fix is the recommended mitigation.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-r26j-h78w-pjqm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-6471"]
- Database Specific Severity
- HIGH
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a7e0365bf8831d5398f843c
Added to database: 08/13/2026, 17:48:21 UTC
Last enriched: 09/24/2026, 08:32:18 UTC
Last updated: 09/28/2026, 01:47:44 UTC
Views: 52
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.