Linux · Security advisory · March 10, 2026

RLSA-2026:4110: Security update for 5 packages

RLSA-2026:4110, released March 10, 2026, fixes 4 CVEs across 5 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0137
72nd percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 4 Routine 0

Fixed package versions

ProductReleaseFixed in
pg_repackrocky 90:1.5.1-1.module+el9.7.0+40012+a654bbaa
pgauditrocky 90:16.0-1.module+el9.7.0+40060+39463e08
pgvectorrocky 90:0.6.2-2.module+el9.7.0+40060+39463e08
postgisrocky 90:3.5.3-3.module+el9.7.0+40012+a654bbaa
postgres-decoderbufsrocky 90:2.4.0-1.Final.module+el9.7.0+40060+39463e08

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-2005 pg_repack: PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Post... 8.8 0.0137 None reported
High CVE-2026-2004 pg_repack: PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Post... 8.8 0.0134 None reported
High CVE-2026-2006 postgresql-private-devel: PostgreSQL is an advanced object-relational database management system (DBMS). Security Fix(es): * postgresql: Post... 8.8 0.0116 None reported
High CVE-2026-2003 libecpg6: Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory 8.8 0.0032 None reported
Showing 1 to 4 of 4 1