Linux Vendors Patch PostgreSQL Flaws Enabling Code Execution and SQL Injection

Red Hat, Oracle Linux, and AlmaLinux released PostgreSQL security updates addressing broad sets of vulnerabilities, including CVE-2026-18408, a restore-time arbitrary-code-execution flaw in malicious pg_dump output, and CVE-2026-14662, where crafted tsvector or tsquery inputs can trigger an out-of-bounds write and potentially execute code as the PostgreSQL operating-system account. CVE-2026-18408 can cause code execution under the client account restoring a dump through psql meta-command expansion; pg_dumpall and some pg_restore workflows are also affected. PostgreSQL fixed these flaws in 18.5, 17.11, 16.15, 15.19, and 14.24.

The updates also address CVE-2026-6476, which permits users with pg_create_subscription rights to arrange superuser SQL execution when pg_createsubscriber runs, and CVE-2026-6638, a logical-replication SQL injection triggered by a crafted replicated table name during ALTER SUBSCRIPTION ... REFRESH PUBLICATION. Red Hat’s Important RHEL 10 advisory RHSA-2026:67280 updates postgresql18 to 18.6 and covers 19 CVEs; Oracle Linux 9 and AlmaLinux 10 advisories similarly cover PostgreSQL 16/18 packages and report exploits as available. Organizations should promptly apply vendor updates, prioritize internet-exposed databases, restrict untrusted dump restoration and subscription-management privileges, and review affected extensions and client tooling.