Linux · Red Hat · Security advisory · September 23, 2026

RHSA-2026:69924: Security update for 16 packages

RHSA-2026:69924, released September 23, 2026, fixes 14 CVEs across 16 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
14
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0068
52nd percentile

Priority of the 14 CVEs

Patch now 0 Urgent 0 High 14 Routine 0

Fixed package versions

ProductReleaseFixed in
pg_repackRHEL 80:1.4.6-3.module+el8.9.0+19330+c97ddbdf
pgauditRHEL 80:1.4.0-7.module+el8.10.0+22214+9beb89d6
postgres-decoderbufsRHEL 80:0.10.0-2.module+el8.9.0+19330+c97ddbdf
postgresqlRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-contribRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-docsRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-plperlRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-plpython3RHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-pltclRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-serverRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-server-develRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-staticRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-testRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-test-rpm-macrosRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-upgradeRHEL 80:12.22-10.module+el8.10.0+24893+321f112b
postgresql-upgrade-develRHEL 80:12.22-10.module+el8.10.0+24893+321f112b

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-16239 PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code8.8 0.0068 None reported
High CVE-2026-14669 postgresql-15: Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary c...8.8 0.0066 None reported
High CVE-2026-15742 PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound8.8 0.0060 None reported
High CVE-2026-6471 PostgreSQL logical decoding can dlopen arbitrary file8.8 0.0053 None reported
High CVE-2026-14662 PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound8.8 0.0046 None reported
High CVE-2026-14664 PostgreSQL regexp heap buffer overflow executes arbitrary code8.8 0.0044 None reported
High CVE-2026-14670 PostgreSQL plperl tied object heap buffer overflow executes arbitrary code8.8 0.0044 None reported
High CVE-2026-19385 PostgreSQL pg_dump heap buffer overflow executes arbitrary code8.8 0.0043 None reported
High CVE-2026-14671 PostgreSQL refint plan cache type confusion executes arbitrary code8.8 0.0042 None reported
High CVE-2026-14680 PostgreSQL type confusion via "internal" arguments8.8 0.0042 None reported
High CVE-2026-14677 PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound8.8 0.0041 None reported
High CVE-2026-6464 PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands8.8 0.0036 None reported
High CVE-2026-14668 PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read8.8 0.0033 None reported
High CVE-2026-14679 postgresql-plperl-14: Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OU...8.8 0.0029 None reported
Showing 1 to 14 of 14 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.