Red Hat PostgreSQL Updates Expand Across RHEL 8, 9, and 10
Tech GuruQuick Answer
Red Hat has issued PostgreSQL 15.19 and 16.15 updates for six RHEL package streams. Stay on the installed supported PostgreSQL major/module branch and use its full fixed RPM release; the two upstream version numbers are not interchangeable upgrade instructions.
Confirm Scope And Apply The Supported Fix
What to do now: Inventory server and client installations, enabled module, RHEL support repository, extensions and replicas. Prepare backup/recovery evidence before applying the complete branch update.
Source check: 2026-10-02 UTC. This notice reflects the primary-source evidence described below, not a completed update or exploitation test. Recheck the advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PostgreSQL 15 and 16 packages for supported RHEL 8, 9, and 10 streams |
|---|---|
| Advisory | RHSA-2026:69876 / RHSA-2026:69923 / RHSA-2026:69914 / RHSA-2026:70186 / RHSA-2026:70602 / RHSA-2026:70559 |
| CVEs | CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669, CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-14679, CVE-2026-14680, CVE-2026-15741, CVE-2026-15742, CVE-2026-16239, CVE-2026-18408, CVE-2026-19385, CVE-2026-6464, CVE-2026-6471 |
| Authoritative release date | RHSA-2026:69876: 2026-09-22T09:24:40+00:00 (CSAF initial release) RHSA-2026:69923: 2026-09-22T11:19:56+00:00 (CSAF initial release) RHSA-2026:69914: 2026-09-22T12:25:16+00:00 (CSAF initial release) RHSA-2026:70186: 2026-09-22T13:21:00+00:00 (CSAF initial release) RHSA-2026:70602: 2026-09-23T08:09:11+00:00 (CSAF initial release) RHSA-2026:70559: 2026-09-23T07:19:51+00:00 (CSAF initial release) |
| Authority revision date | RHSA-2026:69876: 2026-09-22T09:24:40+00:00 (CSAF revision history) RHSA-2026:69923: 2026-09-22T11:19:56+00:00 (CSAF revision history) RHSA-2026:69914: 2026-09-22T12:25:16+00:00 (CSAF revision history) RHSA-2026:70186: 2026-09-22T13:21:00+00:00 (CSAF revision history) RHSA-2026:70602: 2026-09-23T08:09:11+00:00 (CSAF revision history) RHSA-2026:70559: 2026-09-23T07:19:51+00:00 (CSAF revision history). CSAF generation timestamps are not advisory revision dates. |
| Affected versions | The exact entitled PostgreSQL 15 and 16 packages for supported RHEL 8, 9, and 10 streams before their advisory-listed builds |
| Fixed version | PostgreSQL builds (epoch 0; use matching module/repository packages): RHEL 8, postgresql:16 (:69876): 16.15-1.module+el8.10.0+24863+d1dc0d60.RHEL 8, postgresql:15 (:69923): 15.19-1.module+el8.10.0+24831+9c841e4e.RHEL 9, postgresql:15 (:69914): 15.19-1.module+el9.8.0+24800+a95bf172.RHEL 10, postgresql16 (:70186): 16.15-1.el10_2.RHEL 8.8 SAP/TUS, postgresql:15 (:70602): 15.19-1.module+el8.8.0+24926+55068be7.RHEL 9.6 EUS, postgresql:16 (:70559): 16.15-1.module+el9.6.0+24915+52fd15c1. |
| CVSS base score | 7.1 / 7.2 / 7.5 / 8.0 / 8.1 / 8.4 / 8.8 (CVSS v3.1) |
| CVSS severity | High |
| Exploitation status | The six PostgreSQL advisories does not state that these flaws are being exploited. That is not confirmation that exploitation has not occurred. |
What Changed
The sixteen CVEs include server and extension memory/type-handling issues, psql COPY handling and pg_dump processing of untrusted database content. Updating only a database server does not demonstrate that a separate backup or administration host uses the corrected client tools. Individual CVEs have different privilege and feature prerequisites.
What To Validate Now
- Inventory. Locate PostgreSQL 15 and 16 packages for supported RHEL 8, 9, and 10 streams deployments, package versions, enabled services, owners, and dependent workloads.
- Establish applicability. Compare each deployment with the authority's affected-version statement: The exact entitled PostgreSQL 15 and 16 packages for supported RHEL 8, 9, and 10 streams before their advisory-listed builds. Do not infer applicability from product family or severity alone.
- Remediate. Install the full supported package set for the existing PostgreSQL major/module stream. A 15-to-16 migration is a separate project, not a prerequisite implied by this notice. Update separate client/backup hosts where applicable.
- Validate. Read back full package and running-server versions, verify psql/pg_dump on administration hosts, and test representative application queries, extensions, replica health and approved dump/restore workflows.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Use the exact supported release stream and repository. Test dependencies, clusters, integrations, and rollback before broad deployment; a CVSS rating or reachable feature is not evidence of exploitation.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
