Linux · Amazon Linux · Security advisory · August 31, 2026

ALAS2023-2026-2079: Security update for 30 packages

ALAS2023-2026-2079, released August 31, 2026, fixes 27 CVEs across 30 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
27
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile

Priority of the 27 CVEs

Patch now 0 Urgent 0 High 17 Routine 10

Fixed package versions

ProductReleaseFixed in
postgresql18amzn 202318.6-1.amzn2023.0.1
postgresql18-contribamzn 202318.6-1.amzn2023.0.1
postgresql18-contrib-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-debugsourceamzn 202318.6-1.amzn2023.0.1
postgresql18-docsamzn 202318.6-1.amzn2023.0.1
postgresql18-docs-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-llvmjitamzn 202318.6-1.amzn2023.0.1
postgresql18-llvmjit-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-plperlamzn 202318.6-1.amzn2023.0.1
postgresql18-plperl-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-plpython3amzn 202318.6-1.amzn2023.0.1
postgresql18-plpython3-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-pltclamzn 202318.6-1.amzn2023.0.1
postgresql18-pltcl-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-private-develamzn 202318.6-1.amzn2023.0.1
postgresql18-private-libsamzn 202318.6-1.amzn2023.0.1
postgresql18-private-libs-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-serveramzn 202318.6-1.amzn2023.0.1
postgresql18-server-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-server-develamzn 202318.6-1.amzn2023.0.1
postgresql18-server-devel-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-staticamzn 202318.6-1.amzn2023.0.1
postgresql18-testamzn 202318.6-1.amzn2023.0.1
postgresql18-test-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-test-rpm-macrosamzn 202318.6-1.amzn2023.0.1
postgresql18-upgradeamzn 202318.6-1.amzn2023.0.1
postgresql18-upgrade-debuginfoamzn 202318.6-1.amzn2023.0.1
postgresql18-upgrade-develamzn 202318.6-1.amzn2023.0.1
postgresql18-upgrade-devel-debuginfoamzn 202318.6-1.amzn2023.0.1

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-16239 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code8.8 0.0068 None reported
High CVE-2026-14669 postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c...8.8 0.0066 None reported
High CVE-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound8.8 0.0060 None reported
High CVE-2026-6471 PostgreSQL logical decoding can dlopen arbitrary file8.8 0.0053 None reported
High CVE-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound8.8 0.0046 None reported
High CVE-2026-14664 PostgreSQL regexp heap buffer overflow executes arbitrary code8.8 0.0044 None reported
High CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code8.8 0.0044 None reported
High CVE-2026-14676 postgresql-18: Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operat...8.8 0.0044 None reported
High CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument8.8 0.0044 None reported
High CVE-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code8.8 0.0043 None reported
High CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code8.8 0.0042 None reported
High CVE-2026-14680 PostgreSQL type confusion via "internal" arguments8.8 0.0042 None reported
High CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code8.8 0.0041 None reported
High CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands8.8 0.0036 None reported
High CVE-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client8.8 0.0036 None reported
High CVE-2026-14668 PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read8.8 0.0033 None reported
High CVE-2026-14679 postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU...8.8 0.0029 None reported
Routine CVE-2026-14672 PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle5.3 0.0039 None reported
Routine CVE-2026-16241 postgresql-15: Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service ag...3.8 0.0034 None reported
Routine CVE-2026-6470 PostgreSQL fails to check type USAGE privilege4.3 0.0033 None reported
Routine CVE-2026-6469 PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership3.8 0.0032 None reported
Routine CVE-2026-14678 PostgreSQL pg_trgm picksplit reads past end of buffer4.3 0.0030 None reported
Routine CVE-2026-18024 PostgreSQL ascii() function reads past end of buffer4.3 0.0030 None reported
Routine CVE-2026-14673 PostgreSQL amcheck does not clear untrusted search path3.8 0.0027 None reported
Routine CVE-2026-14666 PostgreSQL row security caching disregards role modifications4.2 0.0021 None reported
Showing 1 to 25 of 27 1Next

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.