This advisory covers several vulnerabilities in PostgreSQL 16 on Red Hat Enterprise Linux 10. Specifically, CVE-2026-2006 involves missing validation of multibyte character length, CVE-2026-2004 involves missing validation of input type to the intarray selectivity estimator, and CVE-2026-2005 involves a heap buffer overflow in the pgcrypto module. All these vulnerabilities can result in arbitrary code execution. The update is rated as Important by Red Hat Product Security. The advisory references Red Hat Enterprise Linux 10 and its extended update support and extended life cycle variants across multiple architectures including x86_64, s390x, ppc64le, and aarch64. The advisory does not provide CVSS scores but classifies the impact as Important (high severity).

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code on the affected system. This could compromise the confidentiality, integrity, and availability of the PostgreSQL database server and potentially the host system. The vulnerabilities affect core PostgreSQL components and extensions, increasing the risk of exploitation in environments using these features.

Red Hat has released updated packages for PostgreSQL 16 that address these vulnerabilities. Users of Red Hat Enterprise Linux 10 and related variants should apply the security update as soon as possible. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. Since this is an official security advisory with an available update, applying the vendor-provided patch is the primary recommended mitigation.