SB2026092410 - Red Hat Enterprise Linux 9 update for the postgresql:15 module
Published: September 24, 2026 Updated: September 30, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 13 vulnerabilities.
1) Integer overflow (CVE-ID: CVE-2026-14662)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in tsvector and tsquery data type functions when processing crafted large inputs. A remote user can supply crafted large inputs to cause an undersized allocation and write out-of-bounds to execute arbitrary code.
This may execute code as the operating system user running the database.
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute psql commands.
The vulnerability exists due to untrusted data inclusion in psql COPY FROM STDIN handling when a COPY FROM STDIN or \copy FROM STDIN command fails before the server indicates that it awaits input rows. A remote attacker can trigger an early failure so that in-line data rows are processed as psql commands to execute psql commands.
A complete attack requires control of both the server and the data rows, although an attacker controlling only the data rows might succeed if a coincidental error occurs.
3) Improper Authorization (CVE-ID: CVE-2026-6471)
CWE-ID: CWE-285 - Improper Authorization
CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to improper access control in logical decoding when selecting a logical decoding plugin. A remote privileged user can choose an arbitrary file visible to the server operating system account as a logical decoding plugin to execute arbitrary code.
Exploitation requires the REPLICATION privilege but does not require superuser privileges.
4) Type Confusion (CVE-ID: CVE-2026-14680)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in functions with "internal" argument types when invoking such functions from SQL. A remote user can call functions with that argument type to execute arbitrary code.
Successful exploitation can run code as the operating system user running the database.
5) Heap-based buffer overflow (CVE-ID: CVE-2026-14664)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in PostgreSQL regexp processing when processing text that would not pass encoding validation. A remote user can supply a crafted query containing such text to execute arbitrary code.
Successful exploitation can occur in the context of the operating system user running the database.
6) Integer overflow (CVE-ID: CVE-2026-14677)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in pltcl and plperl when processing crafted function bodies on 32-bit builds. A remote user can create a crafted function body to execute arbitrary code.
Only 32-bit builds are vulnerable.
7) Integer overflow (CVE-ID: CVE-2026-15742)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to integer overflow in the fuzzystrmatch levenshtein() and levenshtein_less_equal() functions when processing extreme SQL inputs. A remote user can supply crafted input values to direct writes to a huge range of addresses and execute arbitrary code.
Code execution occurs as the operating system user running the database.
8) Type Confusion (CVE-ID: CVE-2026-16239)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the portal/cursor lifecycle when re-creating a cursor or other portal with different types. A remote user can re-create a cursor or other portal with different types to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
9) Heap-based buffer overflow (CVE-ID: CVE-2026-14669)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in to_char(timestamptz) when processing a long POSIX timezone abbreviation. A remote user can supply a crafted timezone value to execute arbitrary code.
The code executes as the operating system user running the database.
10) Type Confusion (CVE-ID: CVE-2026-14671)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to type confusion in the refint module plan cache when processing object definitions created in the module. A remote user can create a crafted object to execute arbitrary code.
Successful exploitation results in code execution as the operating system user running the database.
11) Type Confusion (CVE-ID: CVE-2026-14668)
CWE-ID: CWE-843 - Type confusion
CVSSv4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose sensitive information and cause a denial of service.
The vulnerability exists due to type confusion in the ctid data type selectivity estimator when processing a chosen non-ctid input. A remote user can create an object with crafted input to disclose sensitive information and cause a denial of service.
The disclosed value is a calculation derived from an arbitrary 4-byte span of memory, and substantial memory value recovery appears possible despite loss of precision.
12) Heap-based buffer overflow (CVE-ID: CVE-2026-19385)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to heap-based buffer overflow in pg_dump when processing long function transform lists. A remote user can create a crafted transform list to execute arbitrary code.
Code execution occurs as the operating system user running pg_dump.
13) SQL injection (CVE-ID: CVE-2026-15741)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary SQL as a superuser.
The vulnerability exists due to SQL injection in EXTRACT() expression deparse when processing a hostile object definition. A remote attacker can create a crafted object definition to execute arbitrary SQL as a superuser.
User interaction is required when a victim uses an expression deparse consumer such as pg_dump, psql sf, or a similar non-core tool.
Remediation
Install update from vendor's website.