# RHSA-2026:69924: Security update for 16 packages RHSA-2026:69924, released September 23, 2026, fixes 14 CVEs across 16 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/rhsa-2026-69924 - Platform: Linux - Released: Sep 23, 2026 - Priority: High (Closes CVE-2026-16239, high severity) - CVEs: 14, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://access.redhat.com/errata/RHSA-2026:69924 ## Applies to | Product | Release | Fixed in | |---|---|---| | [pg_repack](https://patchblox.com/security/data/product/linux/pg-repack.md) | RHEL 8 | 0:1.4.6-3.module+el8.9.0+19330+c97ddbdf | | [pgaudit](https://patchblox.com/security/data/product/linux/pgaudit.md) | RHEL 8 | 0:1.4.0-7.module+el8.10.0+22214+9beb89d6 | | [postgres-decoderbufs](https://patchblox.com/security/data/product/linux/postgres-decoderbufs.md) | RHEL 8 | 0:0.10.0-2.module+el8.9.0+19330+c97ddbdf | | [postgresql](https://patchblox.com/security/data/product/linux/postgresql.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-contrib](https://patchblox.com/security/data/product/linux/postgresql-contrib.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-docs](https://patchblox.com/security/data/product/linux/postgresql-docs.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-plperl](https://patchblox.com/security/data/product/linux/postgresql-plperl.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-plpython3](https://patchblox.com/security/data/product/linux/postgresql-plpython3.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-pltcl](https://patchblox.com/security/data/product/linux/postgresql-pltcl.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-server](https://patchblox.com/security/data/product/linux/postgresql-server.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-server-devel](https://patchblox.com/security/data/product/linux/postgresql-server-devel.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-static](https://patchblox.com/security/data/product/linux/postgresql-static.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-test](https://patchblox.com/security/data/product/linux/postgresql-test.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-test-rpm-macros](https://patchblox.com/security/data/product/linux/postgresql-test-rpm-macros.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-upgrade](https://patchblox.com/security/data/product/linux/postgresql-upgrade.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | | [postgresql-upgrade-devel](https://patchblox.com/security/data/product/linux/postgresql-upgrade-devel.md) | RHEL 8 | 0:12.22-10.module+el8.10.0+24893+321f112b | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-16239](https://patchblox.com/security/data/cve/CVE-2026-16239.md) | High | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | | | [CVE-2026-14669](https://patchblox.com/security/data/cve/CVE-2026-14669.md) | High | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 | | | [CVE-2026-15742](https://patchblox.com/security/data/cve/CVE-2026-15742.md) | High | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | | | [CVE-2026-6471](https://patchblox.com/security/data/cve/CVE-2026-6471.md) | High | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | | | [CVE-2026-14662](https://patchblox.com/security/data/cve/CVE-2026-14662.md) | High | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | | | [CVE-2026-14664](https://patchblox.com/security/data/cve/CVE-2026-14664.md) | High | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-14670](https://patchblox.com/security/data/cve/CVE-2026-14670.md) | High | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | | | [CVE-2026-19385](https://patchblox.com/security/data/cve/CVE-2026-19385.md) | High | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | | | [CVE-2026-14671](https://patchblox.com/security/data/cve/CVE-2026-14671.md) | High | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | | | [CVE-2026-14680](https://patchblox.com/security/data/cve/CVE-2026-14680.md) | High | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | | | [CVE-2026-14677](https://patchblox.com/security/data/cve/CVE-2026-14677.md) | High | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | | | [CVE-2026-6464](https://patchblox.com/security/data/cve/CVE-2026-6464.md) | High | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | | | [CVE-2026-14668](https://patchblox.com/security/data/cve/CVE-2026-14668.md) | High | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | | | [CVE-2026-14679](https://patchblox.com/security/data/cve/CVE-2026-14679.md) | High | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo