{ "document": { "aggregate_severity": { "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2026-2004: intarray: _int_matchsel() verifies that its input is a\n query_int, and only superusers may attach a non-built-in selectivity\n estimator to an operator (arbitrary code execution)\n- CVE-2026-2005: pgcrypto: reject PGP messages whose session key is longer\n than PGP_MAX_KEY (heap buffer overflow)\n- CVE-2026-2003: reject oidvector and int2vector values that are not\n one-dimensional or contain nulls (server memory disclosure, crash)\n- CVE-2026-18024: ascii(): check the remaining length and the byte values of a\n multibyte character (buffer over-read)\n- CVE-2026-14678: pg_trgm: GiST picksplit no longer reads a cached signature\n as a trigram array (buffer over-read)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_postgresql/el7/advisories/2026/clsa-2026_1793281482.json" } ], "tracking": { "current_release_date": "2026-10-29T13:45:47Z", "generator": { "date": "2026-10-29T13:45:47Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1793281482", "initial_release_date": "2026-10-29T13:45:47Z", "revision_history": [ { "date": "2026-10-29T13:45:47Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "postgresql96: Fix of 5 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Cloud Linux Software, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-contrib@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plpython3@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plpython@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-libs@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-pltcl@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-server@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-docs@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-plperl@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-devel@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } }, { "category": "product_version", "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product": { "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_id": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/postgresql96-test@9.6.24-1PGDG.1.el7.tuxcare.els9?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" }, "product_reference": "postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-2003", "cwe": { "id": "CWE-1287", "name": "Improper Validation of Specified Type of Input" }, "notes": [ { "category": "description", "text": "Improper validation of type \"oidvector\" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2026-2003" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2026-2003/", "url": "https://www.postgresql.org/support/security/CVE-2026-2003/" } ], "release_date": "2026-02-12T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T13:44:43.909935Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2026-2004", "cwe": { "id": "CWE-1287", "name": "Improper Validation of Specified Type of Input" }, "notes": [ { "category": "description", "text": "Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2026-2004" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2026-2004/", "url": "https://www.postgresql.org/support/security/CVE-2026-2004/" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19009", "url": "https://access.redhat.com/errata/RHSA-2026:19009" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19010", "url": "https://access.redhat.com/errata/RHSA-2026:19010" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3730", "url": "https://access.redhat.com/errata/RHSA-2026:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3887", "url": "https://access.redhat.com/errata/RHSA-2026:3887" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3896", "url": "https://access.redhat.com/errata/RHSA-2026:3896" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4024", "url": "https://access.redhat.com/errata/RHSA-2026:4024" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4059", "url": "https://access.redhat.com/errata/RHSA-2026:4059" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4063", "url": "https://access.redhat.com/errata/RHSA-2026:4063" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4064", "url": "https://access.redhat.com/errata/RHSA-2026:4064" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4074", "url": "https://access.redhat.com/errata/RHSA-2026:4074" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4075", "url": "https://access.redhat.com/errata/RHSA-2026:4075" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4110", "url": "https://access.redhat.com/errata/RHSA-2026:4110" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4254", "url": "https://access.redhat.com/errata/RHSA-2026:4254" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4441", "url": "https://access.redhat.com/errata/RHSA-2026:4441" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4475", "url": "https://access.redhat.com/errata/RHSA-2026:4475" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4504", "url": "https://access.redhat.com/errata/RHSA-2026:4504" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4505", "url": "https://access.redhat.com/errata/RHSA-2026:4505" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4506", "url": "https://access.redhat.com/errata/RHSA-2026:4506" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4509", "url": "https://access.redhat.com/errata/RHSA-2026:4509" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4515", "url": "https://access.redhat.com/errata/RHSA-2026:4515" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4516", "url": "https://access.redhat.com/errata/RHSA-2026:4516" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4518", "url": "https://access.redhat.com/errata/RHSA-2026:4518" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4524", "url": "https://access.redhat.com/errata/RHSA-2026:4524" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4528", "url": "https://access.redhat.com/errata/RHSA-2026:4528" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4544", "url": "https://access.redhat.com/errata/RHSA-2026:4544" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4546", "url": "https://access.redhat.com/errata/RHSA-2026:4546" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4547", "url": "https://access.redhat.com/errata/RHSA-2026:4547" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4548", "url": "https://access.redhat.com/errata/RHSA-2026:4548" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4943", "url": "https://access.redhat.com/errata/RHSA-2026:4943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8756", "url": "https://access.redhat.com/errata/RHSA-2026:8756" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-2004", "url": "https://access.redhat.com/security/cve/CVE-2026-2004" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2439325", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439325" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2004.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2004.json" } ], "release_date": "2026-02-12T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T13:44:43.909935Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-2005", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2026-2005" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2026-2005/", "url": "https://www.postgresql.org/support/security/CVE-2026-2005/" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19009", "url": "https://access.redhat.com/errata/RHSA-2026:19009" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:19010", "url": "https://access.redhat.com/errata/RHSA-2026:19010" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3730", "url": "https://access.redhat.com/errata/RHSA-2026:3730" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3887", "url": "https://access.redhat.com/errata/RHSA-2026:3887" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:3896", "url": "https://access.redhat.com/errata/RHSA-2026:3896" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4024", "url": "https://access.redhat.com/errata/RHSA-2026:4024" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4059", "url": "https://access.redhat.com/errata/RHSA-2026:4059" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4063", "url": "https://access.redhat.com/errata/RHSA-2026:4063" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4064", "url": "https://access.redhat.com/errata/RHSA-2026:4064" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4074", "url": "https://access.redhat.com/errata/RHSA-2026:4074" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4075", "url": "https://access.redhat.com/errata/RHSA-2026:4075" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4110", "url": "https://access.redhat.com/errata/RHSA-2026:4110" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4254", "url": "https://access.redhat.com/errata/RHSA-2026:4254" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4441", "url": "https://access.redhat.com/errata/RHSA-2026:4441" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4475", "url": "https://access.redhat.com/errata/RHSA-2026:4475" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4504", "url": "https://access.redhat.com/errata/RHSA-2026:4504" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4505", "url": "https://access.redhat.com/errata/RHSA-2026:4505" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4506", "url": "https://access.redhat.com/errata/RHSA-2026:4506" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4509", "url": "https://access.redhat.com/errata/RHSA-2026:4509" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4515", "url": "https://access.redhat.com/errata/RHSA-2026:4515" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4516", "url": "https://access.redhat.com/errata/RHSA-2026:4516" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4518", "url": "https://access.redhat.com/errata/RHSA-2026:4518" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4524", "url": "https://access.redhat.com/errata/RHSA-2026:4524" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4528", "url": "https://access.redhat.com/errata/RHSA-2026:4528" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4544", "url": "https://access.redhat.com/errata/RHSA-2026:4544" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4546", "url": "https://access.redhat.com/errata/RHSA-2026:4546" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4547", "url": "https://access.redhat.com/errata/RHSA-2026:4547" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4548", "url": "https://access.redhat.com/errata/RHSA-2026:4548" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:4943", "url": "https://access.redhat.com/errata/RHSA-2026:4943" }, { "category": "external", "summary": "https://access.redhat.com/errata/RHSA-2026:8756", "url": "https://access.redhat.com/errata/RHSA-2026:8756" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2026-2005", "url": "https://access.redhat.com/security/cve/CVE-2026-2005" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2439326", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2439326" }, { "category": "external", "summary": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2005.json", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-2005.json" } ], "release_date": "2026-02-12T14:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T13:44:43.909935Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-14678", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2026-14678" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2026-14678/", "url": "https://www.postgresql.org/support/security/CVE-2026-14678/" } ], "release_date": "2026-08-13T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T13:44:43.909935Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2026-18024", "cwe": { "id": "CWE-126", "name": "Buffer Over-read" }, "notes": [ { "category": "description", "text": "Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "title": "Vulnerability description" } ], "product_status": { "fixed": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els-postgresql/cve/CVE-2026-18024" }, { "category": "external", "summary": "https://www.postgresql.org/support/security/CVE-2026-18024/", "url": "https://www.postgresql.org/support/security/CVE-2026-18024/" } ], "release_date": "2026-08-13T13:17:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-10-29T13:44:43.909935Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482", "product_ids": [ "CentOS-7:postgresql96-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-contrib-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-devel-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-docs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-libs-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plperl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-plpython3-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-pltcl-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-server-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64", "CentOS-7:postgresql96-test-0:9.6.24-1PGDG.1.el7.tuxcare.els9.x86_64" ], "url": "https://cve.tuxcare.com/els-postgresql/releases/CLSA-2026:1793281482" } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }