# RHSA-2026:67280: postgresql18 security update

RHSA-2026:67280, released July 18, 2026, fixes 19 CVEs in postgresql18 (version 18.6-1.el10_2). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2026-67280
- Platform: Linux
- Released: Jul 18, 2026
- Priority: High (Closes CVE-2026-16239, high severity)
- CVEs: 19, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2026:67280

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [postgresql18](https://patchblox.com/security/data/product/linux/postgresql18.md) | RHEL 10 | 18.6-1.el10_2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-16239](https://patchblox.com/security/data/cve/CVE-2026-16239.md) | High | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 |  |
| [CVE-2026-14669](https://patchblox.com/security/data/cve/CVE-2026-14669.md) | High | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 |  |
| [CVE-2026-15742](https://patchblox.com/security/data/cve/CVE-2026-15742.md) | High | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 |  |
| [CVE-2026-6471](https://patchblox.com/security/data/cve/CVE-2026-6471.md) | High | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 |  |
| [CVE-2026-14662](https://patchblox.com/security/data/cve/CVE-2026-14662.md) | High | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 |  |
| [CVE-2026-14664](https://patchblox.com/security/data/cve/CVE-2026-14664.md) | High | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 |  |
| [CVE-2026-14670](https://patchblox.com/security/data/cve/CVE-2026-14670.md) | High | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 |  |
| [CVE-2026-14676](https://patchblox.com/security/data/cve/CVE-2026-14676.md) | High | postgresql-18: Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operat... | 8.8 | 0.0044 |  |
| [CVE-2026-15741](https://patchblox.com/security/data/cve/CVE-2026-15741.md) | High | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | 0.0044 |  |
| [CVE-2026-19385](https://patchblox.com/security/data/cve/CVE-2026-19385.md) | High | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 |  |
| [CVE-2026-14671](https://patchblox.com/security/data/cve/CVE-2026-14671.md) | High | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 |  |
| [CVE-2026-14680](https://patchblox.com/security/data/cve/CVE-2026-14680.md) | High | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 |  |
| [CVE-2026-14677](https://patchblox.com/security/data/cve/CVE-2026-14677.md) | High | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 |  |
| [CVE-2026-16238](https://patchblox.com/security/data/cve/CVE-2026-16238.md) | High | PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code | 8.8 | 0.0041 |  |
| [CVE-2026-6464](https://patchblox.com/security/data/cve/CVE-2026-6464.md) | High | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 |  |
| [CVE-2026-18408](https://patchblox.com/security/data/cve/CVE-2026-18408.md) | High | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | 8.8 | 0.0036 |  |
| [CVE-2026-14668](https://patchblox.com/security/data/cve/CVE-2026-14668.md) | High | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 |  |
| [CVE-2026-14679](https://patchblox.com/security/data/cve/CVE-2026-14679.md) | High | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 |  |
| [CVE-2026-6476](https://patchblox.com/security/data/cve/CVE-2026-6476.md) | High | pgaudit: PostgreSQL is an advanced object-relational database management system (DBMS) | 8.8 | 0.0029 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo