The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:27741 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    Security Fix(es):

    * postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and     pg_rewind (CVE-2026-6475)

    * postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory     (CVE-2026-6477)

    * postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison     (CVE-2026-6478)

    * postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write     (CVE-2026-6473)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 9 : postgresql (RHSA-2026:27741)

high Nessus Plugin ID 321942

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jul 4, 2026, 4:43 PM CVSSv3 score source (set to "CVE-2026-6475") Plugin Feed: 202607041643
Version 1.2 Jun 25, 2026, 3:43 PM Detection (updated detection logic) Plugin Feed: 202606251543
Version 1.1 Jun 22, 2026, 2:29 PM New Plugin Feed: 202606221429