Threats Tagged 'cve-2026-16238'

Red Hat Update Infrastructure (RHUI) container images are based on the latest RHUI RPM packages and the ubi9 or ubi9-init base images. This release updates to the latest version.

This security update for PostgreSQL 18 addresses multiple vulnerabilities affecting various components such as psql, logical decoding, pgcrypto, regexp, and others. The issues include heap buffer overflows that can lead to arbitrary code execution, type confusion, integer wraparound causing undersize allocations, privilege enforcement failures, and SQL injection risks. The update fixes these vulnerabilities to improve the security and stability of PostgreSQL 18 and related versions.

A type confusion vulnerability in PostgreSQL's pg_restore_attribute_stats() function allows an object creator to execute arbitrary code as the operating system user running the database. This occurs due to conflation of range and multirange values. The issue affects PostgreSQL major version 18, specifically versions before 18.6. Versions prior to 18.0 are not affected. A patch is available to address this vulnerability.

CVE-2026-16238 is a high-severity type confusion vulnerability in PostgreSQL affecting major version 18 prior to 18.6. It allows an object creator to execute arbitrary code as the operating system user running the database by exploiting conflation of range and multirange values in the pg_restore_attribute_stats() function. Versions before PostgreSQL 18 are not affected.