SB20260921207 - Red Hat Enterprise Linux 9 update for the postgresql:15 module
Published: September 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2026-14662)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in tsvector and tsquery data type functions when processing crafted large inputs. A remote user can supply crafted large inputs to cause an undersized allocation and write out-of-bounds to execute arbitrary code.
This may execute code as the operating system user running the database.
2) Improper Authorization (CVE-ID: CVE-2026-6471)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in logical decoding when selecting a logical decoding plugin. A remote privileged user can choose an arbitrary file visible to the server operating system account as a logical decoding plugin to execute arbitrary code.
Exploitation requires the REPLICATION privilege but does not require superuser privileges.
3) Type Confusion (CVE-ID: CVE-2026-14680)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in functions with "internal" argument types when invoking such functions from SQL. A remote user can call functions with that argument type to execute arbitrary code.
Successful exploitation can run code as the operating system user running the database.
4) Heap-based buffer overflow (CVE-ID: CVE-2026-14664)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in PostgreSQL regexp processing when processing text that would not pass encoding validation. A remote user can supply a crafted query containing such text to execute arbitrary code.
Successful exploitation can occur in the context of the operating system user running the database.
5) Integer overflow (CVE-ID: CVE-2026-14677)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in pltcl and plperl when processing crafted function bodies on 32-bit builds. A remote user can create a crafted function body to execute arbitrary code.
Only 32-bit builds are vulnerable.
6) Integer overflow (CVE-ID: CVE-2026-15742)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in the fuzzystrmatch levenshtein() and levenshtein_less_equal() functions when processing extreme SQL inputs. A remote user can supply crafted input values to direct writes to a huge range of addresses and execute arbitrary code.
Code execution occurs as the operating system user running the database.
7) Type Confusion (CVE-ID: CVE-2026-16239)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the portal/cursor lifecycle when re-creating a cursor or other portal with different types. A remote user can re-create a cursor or other portal with different types to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
8) Heap-based buffer overflow (CVE-ID: CVE-2026-14669)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in to_char(timestamptz) when processing a long POSIX timezone abbreviation. A remote user can supply a crafted timezone value to execute arbitrary code.
The code executes as the operating system user running the database.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-19385)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in pg_dump when processing long function transform lists. A remote user can create a crafted transform list to execute arbitrary code.
Code execution occurs as the operating system user running pg_dump.
Remediation
Install update from vendor's website.