# ELSA-2026-67491: Security update for 24 packages

ELSA-2026-67491, released September 16, 2026, fixes 17 CVEs across 24 products. None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/elsa-2026-67491
- Platform: Linux
- Released: Sep 16, 2026
- Priority: High (Closes CVE-2026-16239, high severity)
- CVEs: 17, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://linux.oracle.com/errata/ELSA-2026-67491.html

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [pg_repack](https://patchblox.com/security/data/product/linux/pg-repack.md) | ol 9 | 0:1.5.1-1.module+el9.8.0+91036+1d936f05 |
| [pgaudit](https://patchblox.com/security/data/product/linux/pgaudit.md) | ol 9 | 0:16.0-1.module+el9.8.0+91036+1d936f05 |
| [pgvector](https://patchblox.com/security/data/product/linux/pgvector.md) | ol 9 | 0:0.6.2-2.module+el9.8.0+91036+1d936f05 |
| [postgis](https://patchblox.com/security/data/product/linux/postgis.md) | ol 9 | 0:3.5.3-6.module+el9.8.0+91036+1d936f05 |
| [postgis-client](https://patchblox.com/security/data/product/linux/postgis-client.md) | ol 9 | 0:3.5.3-6.module+el9.8.0+91036+1d936f05 |
| [postgis-docs](https://patchblox.com/security/data/product/linux/postgis-docs.md) | ol 9 | 0:3.5.3-6.module+el9.8.0+91036+1d936f05 |
| [postgis-upgrade](https://patchblox.com/security/data/product/linux/postgis-upgrade.md) | ol 9 | 0:3.5.3-6.module+el9.8.0+91036+1d936f05 |
| [postgis-utils](https://patchblox.com/security/data/product/linux/postgis-utils.md) | ol 9 | 0:3.5.3-6.module+el9.8.0+91036+1d936f05 |
| [postgres-decoderbufs](https://patchblox.com/security/data/product/linux/postgres-decoderbufs.md) | ol 9 | 0:2.4.0-1.Final.module+el9.8.0+91036+1d936f05 |
| [postgresql](https://patchblox.com/security/data/product/linux/postgresql.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-contrib](https://patchblox.com/security/data/product/linux/postgresql-contrib.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-docs](https://patchblox.com/security/data/product/linux/postgresql-docs.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-plperl](https://patchblox.com/security/data/product/linux/postgresql-plperl.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-plpython3](https://patchblox.com/security/data/product/linux/postgresql-plpython3.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-pltcl](https://patchblox.com/security/data/product/linux/postgresql-pltcl.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-private-devel](https://patchblox.com/security/data/product/linux/postgresql-private-devel.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-private-libs](https://patchblox.com/security/data/product/linux/postgresql-private-libs.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-server](https://patchblox.com/security/data/product/linux/postgresql-server.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-server-devel](https://patchblox.com/security/data/product/linux/postgresql-server-devel.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-static](https://patchblox.com/security/data/product/linux/postgresql-static.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-test](https://patchblox.com/security/data/product/linux/postgresql-test.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-test-rpm-macros](https://patchblox.com/security/data/product/linux/postgresql-test-rpm-macros.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-upgrade](https://patchblox.com/security/data/product/linux/postgresql-upgrade.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |
| [postgresql-upgrade-devel](https://patchblox.com/security/data/product/linux/postgresql-upgrade-devel.md) | ol 9 | 0:16.15-1.module+el9.8.0+91036+1d936f05 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-16239](https://patchblox.com/security/data/cve/CVE-2026-16239.md) | High | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 |  |
| [CVE-2026-14669](https://patchblox.com/security/data/cve/CVE-2026-14669.md) | High | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 |  |
| [CVE-2026-15742](https://patchblox.com/security/data/cve/CVE-2026-15742.md) | High | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 |  |
| [CVE-2026-73515](https://patchblox.com/security/data/cve/CVE-2026-73515.md) | High | postgresql16-postgis: PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosu... | 8.8 | 0.0057 |  |
| [CVE-2026-6471](https://patchblox.com/security/data/cve/CVE-2026-6471.md) | High | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 |  |
| [CVE-2026-14662](https://patchblox.com/security/data/cve/CVE-2026-14662.md) | High | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 |  |
| [CVE-2026-14664](https://patchblox.com/security/data/cve/CVE-2026-14664.md) | High | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 |  |
| [CVE-2026-14670](https://patchblox.com/security/data/cve/CVE-2026-14670.md) | High | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 |  |
| [CVE-2026-15741](https://patchblox.com/security/data/cve/CVE-2026-15741.md) | High | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 |  |
| [CVE-2026-19385](https://patchblox.com/security/data/cve/CVE-2026-19385.md) | High | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 |  |
| [CVE-2026-14671](https://patchblox.com/security/data/cve/CVE-2026-14671.md) | High | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 |  |
| [CVE-2026-14680](https://patchblox.com/security/data/cve/CVE-2026-14680.md) | High | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 |  |
| [CVE-2026-14677](https://patchblox.com/security/data/cve/CVE-2026-14677.md) | High | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 |  |
| [CVE-2026-6464](https://patchblox.com/security/data/cve/CVE-2026-6464.md) | High | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 |  |
| [CVE-2026-18408](https://patchblox.com/security/data/cve/CVE-2026-18408.md) | High | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 |  |
| [CVE-2026-14668](https://patchblox.com/security/data/cve/CVE-2026-14668.md) | High | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 |  |
| [CVE-2026-14679](https://patchblox.com/security/data/cve/CVE-2026-14679.md) | High | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo