Linux · Security advisory · June 22, 2026

ALSA-2026:27743: Security update for 15 packages

ALSA-2026:27743, released June 22, 2026, fixes 9 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
9
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0101
63rd percentile

Priority of the 9 CVEs

Patch now 0 Urgent 0 High 7 Routine 2

Fixed package versions

ProductReleaseFixed in
postgresqlalmalinux 1016.14-1.el10_2
postgresql-contribalmalinux 1016.14-1.el10_2
postgresql-docsalmalinux 1016.14-1.el10_2
postgresql-plperlalmalinux 1016.14-1.el10_2
postgresql-plpython3almalinux 1016.14-1.el10_2
postgresql-pltclalmalinux 1016.14-1.el10_2
postgresql-private-develalmalinux 1016.14-1.el10_2
postgresql-private-libsalmalinux 1016.14-1.el10_2
postgresql-serveralmalinux 1016.14-1.el10_2
postgresql-server-develalmalinux 1016.14-1.el10_2
postgresql-staticalmalinux 1016.14-1.el10_2
postgresql-testalmalinux 1016.14-1.el10_2
postgresql-test-rpm-macrosalmalinux 1016.14-1.el10_2
postgresql-upgradealmalinux 1016.14-1.el10_2
postgresql-upgrade-develalmalinux 1016.14-1.el10_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound 8.8 0.0101 None reported
High CVE-2026-6479 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion 7.5 0.0060 None reported
High CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel 8.8 0.0056 None reported
High CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory 8.8 0.0045 None reported
High CVE-2026-6475 PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice 8.8 0.0041 None reported
High CVE-2026-6637 PostgreSQL refint allows stack buffer overflow and SQL injection 8.8 0.0037 None reported
High CVE-2026-6638 PostgreSQL REFRESH PUBLICATION allows SQL injection via table name 8.8 0.0018 None reported
Routine CVE-2026-6474 PostgreSQL timeofday() can disclose portions of server memory 4.3 0.0021 None reported
Routine CVE-2026-6472 PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege 5.4 0.0016 None reported
Showing 1 to 9 of 9 1