This advisory covers four security vulnerabilities in PostgreSQL packages distributed with Red Hat Enterprise Linux 9, specifically affecting PostgreSQL 15. The vulnerabilities include: CVE-2026-2003, which causes disclosure of a few bytes of memory via the oidvector type; CVE-2026-2006, a missing validation of multibyte character length leading to arbitrary code execution; CVE-2026-2004, missing validation of input type to the intarray selectivity estimator allowing arbitrary code execution; and CVE-2026-2005, a heap buffer overflow in the pgcrypto module that can lead to arbitrary code execution. Red Hat has released updated packages to fix these issues in PostgreSQL 15.17 and related modules for Red Hat Enterprise Linux 9.

The vulnerabilities allow an attacker to potentially execute arbitrary code on affected systems or disclose small amounts of memory, which could lead to further exploitation. The issues arise from insufficient input validation and buffer overflow conditions in PostgreSQL components. Successful exploitation could compromise the confidentiality, integrity, and availability of the database system.

Red Hat has released updated PostgreSQL packages (e.g., postgresql-15.17) for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official security updates promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No alternative mitigations or workarounds are specified. Patch status is confirmed as available via the vendor advisory.