Linux · 
Rocky Linux · Security advisory · September 23, 2026
Rocky Linux · Security advisory · September 23, 2026RLSA-2026:69924: Security update for 4 packages
RLSA-2026:69924, released September 23, 2026, fixes 14 CVEs across 4 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile
Priority of the 14 CVEs
Patch now 0
Urgent 0
High 14
Routine 0
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| pg_repack | rocky 8 | 0:1.4.6-3.module+el8.10.0+1862+29bef648 |
| pgaudit | rocky 8 | 0:1.4.0-7.module+el8.9.0+1735+a332307b |
| postgres-decoderbufs | rocky 8 | 0:0.10.0-2.module+el8.10.0+40055+b85d5ce2 |
| postgresql | rocky 8 | 0:12.22-10.module+el8.10.0+40333+409bd81c |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2026-16239 | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | 0.0068 | None reported |
| High | CVE-2026-14669 | postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c... | 8.8 | 0.0066 | None reported |
| High | CVE-2026-15742 | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | 0.0060 | None reported |
| High | CVE-2026-6471 | PostgreSQL logical decoding can dlopen arbitrary file | 8.8 | 0.0053 | None reported |
| High | CVE-2026-14662 | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | 0.0046 | None reported |
| High | CVE-2026-14664 | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-14670 | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | 0.0044 | None reported |
| High | CVE-2026-19385 | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | 0.0043 | None reported |
| High | CVE-2026-14671 | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14680 | PostgreSQL type confusion via "internal" arguments | 8.8 | 0.0042 | None reported |
| High | CVE-2026-14677 | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | 0.0041 | None reported |
| High | CVE-2026-6464 | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.8 | 0.0036 | None reported |
| High | CVE-2026-14668 | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.8 | 0.0033 | None reported |
| High | CVE-2026-14679 | postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU... | 8.8 | 0.0029 | None reported |
Showing 1 to 14 of 14
1
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.