Linux · Security advisory · July 18, 2026

RHSA-2026:67848: Security update for 24 packages

RHSA-2026:67848, released July 18, 2026, fixes 20 CVEs across 24 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
20
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0068
52nd percentile

Priority of the 20 CVEs

Patch now 0 Urgent 0 High 20 Routine 0

Fixed package versions

ProductReleaseFixed in
pg_repackRHEL 90:1.5.3-1.module+el9.8.0+23739+1c42644c
pgauditRHEL 90:18.0-1.module+el9.8.0+23739+1c42644c
pgvectorRHEL 90:0.8.1-1.module+el9.8.0+23739+1c42644c
postgisRHEL 90:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-clientRHEL 90:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-docsRHEL 90:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-upgradeRHEL 90:3.6.1-4.module+el9.8.0+24879+1364ef12
postgis-utilsRHEL 90:3.6.1-4.module+el9.8.0+24879+1364ef12
postgres-decoderbufsRHEL 90:3.3.1-1.Final.module+el9.8.0+23739+1c42644c
postgresqlRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-contribRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-docsRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plperlRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-plpython3RHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-pltclRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-private-develRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-private-libsRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-serverRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-server-develRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-staticRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-testRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-test-rpm-macrosRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgradeRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535
postgresql-upgrade-develRHEL 90:18.6-1.module+el9.8.0+24816+5c11f535

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-16239 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code 8.8 0.0068 None reported
High CVE-2026-14669 postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... 8.8 0.0066 None reported
High CVE-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound 8.8 0.0060 None reported
High CVE-2026-73515 postgresql16-postgis: PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosu... 8.8 0.0057 None reported
High CVE-2026-6471 PostgreSQL logical decoding can dlopen arbitrary file 8.8 0.0053 None reported
High CVE-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound 8.8 0.0046 None reported
High CVE-2026-14664 PostgreSQL regexp heap buffer overflow executes arbitrary code 8.8 0.0044 None reported
High CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code 8.8 0.0044 None reported
High CVE-2026-14676 postgresql-18: Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operat... 8.8 0.0044 None reported
High CVE-2026-15741 PostgreSQL expression deparse allows SQL injection via EXTRACT argument 8.8 0.0044 None reported
High CVE-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code 8.8 0.0043 None reported
High CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code 8.8 0.0042 None reported
High CVE-2026-14680 PostgreSQL type confusion via "internal" arguments 8.8 0.0042 None reported
High CVE-2026-14677 PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound 8.8 0.0041 None reported
High CVE-2026-16238 PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code 8.8 0.0041 None reported
High CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands 8.8 0.0036 None reported
High CVE-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client 8.8 0.0036 None reported
High CVE-2026-14668 PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read 8.8 0.0033 None reported
High CVE-2026-14679 postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... 8.8 0.0029 None reported
High CVE-2026-6476 pgaudit: PostgreSQL is an advanced object-relational database management system (DBMS) 8.8 0.0029 None reported
Showing 1 to 20 of 20 1