RHSA-2026:35880: Important: libpq security update
Important: libpq security update
Other sources
The libpq package provides the PostgreSQL client library, which allows client programs to connect to PostgreSQL servers. Security Fix(es): postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind (CVE-2026-6475) postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477) postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478) postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libpqto a version that resolves this vulnerability.Fixed in 13.23-1.el8_8.1 - Upgrade
Upgrade
redhat/libpq-debuginfoto a version that resolves this vulnerability.Fixed in 13.23-1.el8_8.1 - Upgrade
Upgrade
redhat/libpq-debugsourceto a version that resolves this vulnerability.Fixed in 13.23-1.el8_8.1 - Upgrade
Upgrade
redhat/libpq-develto a version that resolves this vulnerability.Fixed in 13.23-1.el8_8.1 - Upgrade
Upgrade
redhat/libpq-devel-debuginfoto a version that resolves this vulnerability.Fixed in 13.23-1.el8_8.1 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Patch CVE-2026-6475 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Patch CVE-2026-6477 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Patch CVE-2026-6478 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Patch CVE-2026-6473 - Upgrade
Upgrade
postgresql libpqto a version that resolves this vulnerability.Patch libpq security update
Event History
Frequently Asked Questions
What is the severity of RHSA-2026:35880?
The severity of RHSA-2026:35880 is classified as high with a score of 7.
What security issues does RHSA-2026:35880 address?
RHSA-2026:35880 addresses vulnerabilities related to operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475).
How do I fix RHSA-2026:35880?
To fix RHSA-2026:35880, update the libpq package to the latest version provided in the security advisory.
What software is affected by RHSA-2026:35880?
The affected software includes various versions of the libpq package for Red Hat Enterprise Linux Server and related debug packages.
What is the purpose of the libpq security update in RHSA-2026:35880?
The purpose of the libpq security update in RHSA-2026:35880 is to address security vulnerabilities that could allow unauthorized access to PostgreSQL servers.