Linux · Security advisory · September 16, 2026

ELSA-2026-67848: Security update for 24 packages

ELSA-2026-67848, released September 16, 2026, fixes 3 CVEs across 24 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0044
38th percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
pg_repackol 90:1.5.3-1.module+el9.8.0+90922+3defa420
pgauditol 90:18.0-1.module+el9.8.0+90922+3defa420
pgvectorol 90:0.8.1-1.module+el9.8.0+90922+3defa420
postgisol 90:3.6.1-4.module+el9.8.0+91037+efa47639
postgis-clientol 90:3.6.1-4.module+el9.8.0+91037+efa47639
postgis-docsol 90:3.6.1-4.module+el9.8.0+91037+efa47639
postgis-upgradeol 90:3.6.1-4.module+el9.8.0+91037+efa47639
postgis-utilsol 90:3.6.1-4.module+el9.8.0+91037+efa47639
postgres-decoderbufsol 90:3.3.1-1.Final.module+el9.8.0+90922+3defa420
postgresqlol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-contribol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-docsol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-plperlol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-plpython3ol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-pltclol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-private-develol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-private-libsol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-serverol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-server-develol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-staticol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-testol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-test-rpm-macrosol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-upgradeol 90:18.6-1.module+el9.8.0+91037+efa47639
postgresql-upgrade-develol 90:18.6-1.module+el9.8.0+91037+efa47639

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-14676 postgresql-18: Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operat... 8.8 0.0044 None reported
High CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code 8.8 0.0041 None reported
High CVE-2026-6476 pgaudit: PostgreSQL is an advanced object-relational database management system (DBMS) 8.8 0.0029 None reported
Showing 1 to 3 of 3 1