Güvenlik Danışarlıklarına Dön

Postgresql:16 Security Update — AlmaLinux 8 (ALSA-2026:4063)

ALSA-2026:4063 updates PostgreSQL 16 on AlmaLinux 8 to 16.13, fixing CVE-2026-2006, CVE-2026-2004 and CVE-2026-2005 (CVSS 8.8) — led by missing validation of multibyte character length that allows arbitrary code execution during character encoding conversion. Update the module and restart: dnf update postgresql within the postgresql:16 stream, then restart PostgreSQL.

High 8.8 CVSS
AlmaLinux 8

SharedLicense lisansı altında bunun anlamı

Code execution inside PostgreSQL from character-conversion input means database takeover — every database, role and table on the instance is behind that boundary.

aarch64 postgresql-pltcl-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 11d6240f5f96f4cdf5f11ae59b4ade97f752d4f94aca1e798a3e41e57a957d3e aarch64 postgresql-plperl-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 146378969f342cb46f22d11edc3866d577432594cfaff3d4a2dcff81f33cd284 aarch64 postgresql-server-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 1ed037a8edcc58210401592a2672c5d6df43220b5b7f49ebe04281fdb2a905e3 aarch64 postgresql-static-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 33b27cb20349866a9e5f79f4d37179a933c6e79b2f2d5c26b85b7c49640e6636 aarch64 postgresql-private-libs-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 3e62af1432db7e4ea9fa6cd5dd86e1f50596d55cb00a7ea1efcb64074fab7595 aarch64 postgres-decoderbufs-2.4.0-1.Final.module_el8.10.0+3798+606ebb9f.aarch64.rpm 6f4853faa487b4bdf999e4233e7c50ddad0d2a5925223d555635b89fc917dff8 aarch64 postgresql-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 7c7f5eaca0d4cbc671cce1296e91ed69dc363921c82e74106517199e61132b7a aarch64 postgresql-private-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 85064566a54286bd005e728704beea8a83a14c32c2ef2cb39b0c26f00c98f36b aarch64 postgresql-test-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm 947ba4929d75807756b09da4cd156c69dbdf57dd2611ab921d7aa3817150067b aarch64 postgresql-upgrade-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm ad08ad465aac2591a31a5e513238be34a9602f6b713b4c715baabab802afdb3b aarch64 pg_repack-1.5.1-1.module_el8.10.0+3930+ecf33554.aarch64.rpm b424749179d11a40d010ebd1944ffe90c3feb14d8cbcb1e46053ee9c3995c640 aarch64 postgresql-upgrade-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm cb640380b292cbe43a8bc24b41c8126ecdccf3de63d4fc80b63729527290bb07 aarch64 pgaudit-16.0-1.module_el8.10.0+3798+606ebb9f.aarch64.rpm cda70498ebc7717adc2a3c5a2e380d495e13de64a75c6212b5e7d13875e02354 aarch64 postgresql-contrib-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm d040d20a81513fb4af9c96d6996fe7d71cd7d6ec23222feb383fb494ab4144f9 aarch64 postgresql-server-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm d53d6adbcd8c15175327f440f4e0acfe008d0ba34b6fdc3be0be70f89a28fa32 aarch64 postgresql-docs-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm e1ed883293371bc8667273fe4b0f1b84584f4b8b33a963e3fe604af2609d9380 aarch64 postgresql-plpython3-16.13-1.module_el8.10.0+4125+ceaf7d1b.aarch64.rpm fb55a2ddda660fc583019f926899d51f728377c7795c689d209d2cff58363cd3 noarch postgresql-test-rpm-macros-16.13-1.module_el8.10.0+4125+ceaf7d1b.noarch.rpm a0ed26cda5836bb028d575f7dd5905462e7c40c788798f14f5cd0e77c314376b ppc64le postgresql-upgrade-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 07bd7b7ac05c5ffc91c6d791ca4b8f0156e14a5b068c01d3cdb3feee8cd9fd69 ppc64le postgresql-contrib-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 188793973a2150addf64bc7b6eb946499d92a1b5fb80b02f9ae3f8379834f860 ppc64le postgresql-test-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 3801b2100b72fa5f3d0cd7a471125ddebf205453f9fb4ebf8c853d2c6b6fe660 ppc64le postgres-decoderbufs-2.4.0-1.Final.module_el8.10.0+3798+606ebb9f.ppc64le.rpm 3e6878f0b782f73fca85a647168df8eee7f52a6d92b72e88661fbf1ca6a3df8b ppc64le postgresql-docs-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 431f86ce6571045a952da64bfe274f1196d10d6947668b8e7439e3cc2f82d2d4 ppc64le postgresql-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 51751f7d2ab73277ed910b76ccae698739725b447d54d3b0971a9079754f0ce0 ppc64le postgresql-plperl-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 592d9b6766f735c9d8f29c817b4dd83a2ef6b85489a69c44b66f238bafd07703 ppc64le pg_repack-1.5.1-1.module_el8.10.0+3930+ecf33554.ppc64le.rpm 6b34e8835b78a21510cc0895efe3fd4a89c04c69c7dc93cefa5b0a4e28c10bdf ppc64le postgresql-pltcl-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 725d7e957a1a143d10e78e36194dc4538fe0749967ce029abbe86eea32c1d2ff ppc64le postgresql-upgrade-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 82299a73a4bcd60f6095a86bbff27eeeb81bf2afa4d4521d94b6bc33d2983762 ppc64le postgresql-private-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 83e5520da614451db27d0e7f196b11c720542e4c66b495e237b9dabd81892aeb ppc64le postgresql-server-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 89c19d15688cbc15016e45a6ea4d6979aab302d156c4ed55e63d924f221b2c7f ppc64le postgresql-plpython3-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm 8d07094cc0f28e2a6f8883e4045e2fae60dd64a29688676bcb8e36a848268ecf ppc64le postgresql-private-libs-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm b7a3c21193bf5803a0d5b912299386e49ef585f74952b3507a741a7262c2211c ppc64le postgresql-static-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm d6cf5a90c89e3be1f395042068df728bc17400977915dea697d6d9d37cd99039 ppc64le pgaudit-16.0-1.module_el8.10.0+3798+606ebb9f.ppc64le.rpm ed97f9c208b111c7d8dd7fa730574b5fe02f80a886cea7fab804be15f8eab2e9 ppc64le postgresql-server-16.13-1.module_el8.10.0+4125+ceaf7d1b.ppc64le.rpm facf741646afe2f0594819bf13a368b69b7c997999475789b4ed94fe02e33fc8 s390x postgresql-docs-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 14a91ad2335e71001b7477f0b563944431e734f5a908aa00ec69082bab1c20a6 s390x postgresql-pltcl-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 17fb381ab3ff03639ccb109567e7a83145e64eb93dcc43cc416b3920081dd805 s390x postgresql-plperl-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 39e7ac3108c97d53552dfb9b75bf80d6485a6193cbd9775ea02b8ce13d4e86d7 s390x postgresql-upgrade-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 43afffdbe8e96797675082d05f87221d877196d5ac70cd100445fb4498112146 s390x postgresql-test-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 7d37de8f739fb7daa52fb6f44bc66c102c8f0e96062844a9aec0d154eb3e90da s390x postgresql-contrib-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 8c8348ec1ab77c080c7d96667dcfd216a83367e7b04d16c512fb3c7355af7c79 s390x postgresql-plpython3-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm 93ca4b209092152afcc1b59476659defae9d731a05d0ddb06cd2222be9e26425 s390x pg_repack-1.5.1-1.module_el8.10.0+3930+ecf33554.s390x.rpm 9b13f1d5444f6cf8500fa428e1512f73c0cf1f4ddddd6964d429433ae4e5f724 s390x postgresql-private-libs-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm a78f406b19a0a73a9eff8d1fb4d785168d33bfa5f14ee08bf157be88a58bd3f4 s390x postgres-decoderbufs-2.4.0-1.Final.module_el8.10.0+3798+606ebb9f.s390x.rpm b4ab4ce80d621ce9e80cef82edec35ef1ab32c9448d690e668db0bb17bd1a90a s390x postgresql-server-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm bbbe113cb2a3d847b797ed88d082bc68037ca09d0d02be9a8cc1143634366dd7 s390x postgresql-private-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm ce048f068071cfef3a77f2f19cce19d43ebe0ee497135501578dc69186f40d62 s390x postgresql-upgrade-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm cf467c80fda11dcc496ebfcec19e88ac65042c516b350125d1a5c1b46c32659d s390x pgaudit-16.0-1.module_el8.10.0+3798+606ebb9f.s390x.rpm e1395e420ef0b455c809e9fbbc50b5a27410be72d91603805a4907b86ca95cce s390x postgresql-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm e54d0f503b4a3c8d84200f2c502a37f6163849ea3ab89c222ffce9cff21cc76e s390x postgresql-server-devel-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm e7707f03956f8190f8aaf769bdae9449a1bb1680ed43a86d526afe39f8f4437f s390x postgresql-static-16.13-1.module_el8.10.0+4125+ceaf7d1b.s390x.rpm fcde828037b23273500e5cca84b293613f7955fbc4a5418f822efc7b00238792 x86_64 postgresql-static-16.13-1.module_el8.10.0+4125+ceaf7d1b.x86_64.rpm 0276ced40562a108543464d152e1a7b96d18990ddb09fa59f6e87322bb61bc00 x86_64 postgresql-plperl-16.13-1.module_el8.10.0+4125+ceaf7d1b.x86_64.rpm 0456d554c4e7441769621bda877325fa99393ce86dd2750c5dfa9f56ad00ee15 x86_64 postgresql-docs-16.13-1.module_el8.10.0+4125+ceaf7d1b.x86_64.rpm 189da7854707f2eccdfba8c257863341fb61459e837d4ca594a3b01f2aab9134 x86_64 postgresql-server-16.13-1.module_el8.10.0+4125+ceaf7d1b.x86_64.rpm 2720f7a6f2ec0cec773c12e20d2b51923be059db31a1b1e74ebb239d1246c37c x86_64 postgresql-upgrade-16.13-1.module_el8.10.0+4125+ceaf7d1b.x86_64.rpm 30a20075568972e681b5ce2806626452da7bf0d7a4c169b3cd69cc7fb992243c

Sıkça Sorulan Sorular

What is CVE-2026-2006?
It is a missing-validation flaw in PostgreSQL's multibyte character length handling that allows arbitrary code execution during encoding conversion (CWE-129 Improper Validation of Array Index among the related entries), rated CVSS 8.8 and fixed in PostgreSQL 16.13.
Who is affected?
AlmaLinux 8 servers running the PostgreSQL 16 module before 16.13 — database servers, application backends and any service using the packaged PostgreSQL.
How do I apply the fix?
Back up your databases, run dnf update postgresql* (module postgresql:16), restart PostgreSQL, and verify with psql --version reporting 16.13.
Why does an encoding-conversion flaw reach code execution?
Character-encoding conversion parses client-supplied byte sequences — missing length validation there lets crafted input corrupt memory, the standard path from parsing bug to code execution.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Qt5-Qtdeclarative Security Update — AlmaLinux 8 (ALSA-2026:96075)

2026-11-10

Webkit2gtk3 Security Update — AlmaLinux 8 (ALSA-2026:96080)

2026-11-09

Util-Linux Security Update — AlmaLinux 8 (ALSA-2026:96212)

2026-11-09

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin