This advisory covers four security vulnerabilities in PostgreSQL 16 affecting Red Hat Enterprise Linux 10 and related distributions. The vulnerabilities include CVE-2026-2003 (memory disclosure in oidvector), CVE-2026-2006 (missing validation of multibyte character length leading to arbitrary code execution), CVE-2026-2004 (missing validation of input type to intarray selectivity estimator leading to arbitrary code execution), and CVE-2026-2005 (heap buffer overflow in pgcrypto leading to arbitrary code execution). Red Hat has released updated packages (postgresql16-16.13-1.el10_2) that fix these issues. The advisory rates the security impact as Important and provides detailed package updates for multiple architectures and variants of Red Hat Enterprise Linux 10.

Successful exploitation of these vulnerabilities could lead to disclosure of a few bytes of memory or arbitrary code execution on affected systems running vulnerable PostgreSQL 16 versions. This poses a significant risk to the confidentiality and integrity of the database server and potentially the host system.

Red Hat has released updated PostgreSQL 16 packages (version 16.13-1.el10_2) for Red Hat Enterprise Linux 10 and related CodeReady Linux Builder variants that address these vulnerabilities. Users should apply these official updates promptly to remediate the security issues. For detailed update instructions, refer to Red Hat's official article at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.