The libpq package, which provides the PostgreSQL client library for connecting client programs to PostgreSQL servers, contains a buffer overflow vulnerability (CVE-2026-6477). This flaw allows a server superuser to overwrite client stack memory, potentially leading to memory corruption on the client side. Red Hat Product Security has rated this vulnerability as important and has released updated libpq packages for Red Hat Enterprise Linux 8.6 Extended Life Cycle Long Life and AUS variants to remediate the issue. No CVSS score is provided in the advisory, and no known exploits in the wild have been reported.

The vulnerability enables a PostgreSQL server superuser to cause a buffer overflow in the client library, which can overwrite client stack memory. This could lead to client-side memory corruption, potentially impacting the stability or security of client applications using libpq. The advisory does not specify further exploitation details or impacts beyond the memory overwrite capability.

Red Hat has released updated libpq packages for Red Hat Enterprise Linux 8.6 Extended Life Cycle Long Life and AUS variants that fix this vulnerability. Users should apply the security update as described in the Red Hat advisory RHSA-2026:47090 and the referenced article https://access.redhat.com/articles/11258 to remediate the issue. No other mitigation steps are indicated or required according to the vendor advisory.