Linux · Security advisory · June 24, 2026

RHSA-2026:28037: Security update for 18 packages

RHSA-2026:28037, released June 24, 2026, fixes 8 CVEs across 18 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
8
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0101
63rd percentile

Priority of the 8 CVEs

Patch now 0 Urgent 0 High 6 Routine 2

Fixed package versions

ProductReleaseFixed in
pg_repackRHEL 90:1.4.8-2.module+el9.8.0+24091+17775505
pgauditRHEL 90:1.7.0-1.module+el9.8.0+24091+17775505
postgres-decoderbufsRHEL 90:1.9.7-1.Final.module+el9.8.0+24091+17775505
postgresqlRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-contribRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-docsRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-plperlRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-plpython3RHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-pltclRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-private-develRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-private-libsRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-serverRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-server-develRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-staticRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-testRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-test-rpm-macrosRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-upgradeRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e
postgresql-upgrade-develRHEL 90:15.18-1.module+el9.8.0+24358+32c5830e

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-6473 PostgreSQL server undersizes allocations, via integer wraparound 8.8 0.0101 None reported
High CVE-2026-6479 PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion 7.5 0.0060 None reported
High CVE-2026-6478 PostgreSQL discloses MD5-hashed passwords via covert timing channel 8.8 0.0056 None reported
High CVE-2026-6477 PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory 8.8 0.0045 None reported
High CVE-2026-6475 PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice 8.8 0.0041 None reported
High CVE-2026-6637 PostgreSQL refint allows stack buffer overflow and SQL injection 8.8 0.0037 None reported
Routine CVE-2026-6474 PostgreSQL timeofday() can disclose portions of server memory 4.3 0.0021 None reported
Routine CVE-2026-6472 PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege 5.4 0.0016 None reported
Showing 1 to 8 of 8 1