Linux · Security advisory · June 24, 2026

ELSA-2026-28037: Security update for 18 packages

ELSA-2026-28037, released June 24, 2026, fixes 4 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0101
63rd percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
pg_repackol 90:1.4.8-2.module+el9.8.0+90926+92e334e4
pgauditol 90:1.7.0-1.module+el9.8.0+90926+92e334e4
postgres-decoderbufsol 90:1.9.7-1.Final.module+el9.8.0+90926+92e334e4
postgresqlol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-contribol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-docsol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-plperlol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-plpython3ol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-pltclol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-private-develol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-private-libsol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-serverol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-server-develol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-staticol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-testol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-test-rpm-macrosol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-upgradeol 90:15.18-1.module+el9.8.0+90926+92e334e4
postgresql-upgrade-develol 90:15.18-1.module+el9.8.0+90926+92e334e4

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound 8.8 0.0101 None reported
High CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel 8.8 0.0056 None reported
High CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory 8.8 0.0045 None reported
High CVE-2026-6475 PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice 8.8 0.0041 None reported
Showing 1 to 4 of 4 1