Detections
Analytics

Oracle Linux 9 : postgresql:18 (ELSA-2026-26204)

high Nessus Plugin ID 325724

Synopsis

The remote Oracle Linux host is missing one or more security updates.

Description

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26204 advisory.

 pgaudit [18.0-1]
 - Update to 18.0
 - Initial import for postgresql18

 pg_repack [1.5.3-1]
 - Update to 1.5.3
 - Initial import for postgresql18

 [1.5.1-1]
 - Update to v1.5.1

 [1.4.8-2]
 - Add new build dependencies to fix build with lz4 enabled
 - Related: RHEL-47604

 pgvector [0.8.1-1]
 - Update to 0.8.1
 - Initial import for postgresql18

 [0.6.2-2]
 - Enable Portable build
 - Resolves: RHEL-84405

 [0.6.2-1]
 - Initial packaging

 postgis [3.6.1-1]
 - Update to 3.6.1
 - Initial import for postgresql18
 - Avoid perl(Pg) dependency on RHEL

 [3.5.3-3]
 - Rebuild (gdal)

 [3.5.3-2]
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild

 [3.5.3-1]
 - Update to 3.5.3

 [3.5.2-2]
 - Rebuild (SFCGAL)

 [3.5.2-1]
 - Update to 3.5.2

 [3.5.1-2]
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild

 [3.5.1-1]
 - Update to 3.5.1

 [3.5.0-3]
 - Rebuild (GDAL)

 [3.5.0-2]
 - Rebuild (gdal)

 postgres-decoderbufs [3.3.1-1.Final]
 - Update to 3.3.1.Final
 - Initial import for postgresql18

 postgresql [18.4-1]
 - Update to 18.4
 - Fix CVE-2026-6478

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

See Also

https://linux.oracle.com/errata/ELSA-2026-26204.html

Plugin Details

Severity: High

ID: 325724

File Name: oraclelinux_ELSA-2026-26204.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 7/9/2026

Updated: 7/9/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-6477

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-6475

Vulnerability Information

CPE: p-cpe:/a:oracle:linux:postgresql, p-cpe:/a:oracle:linux:postgresql-contrib, p-cpe:/a:oracle:linux:postgresql-docs, p-cpe:/a:oracle:linux:postgresql-server, p-cpe:/a:oracle:linux:postgresql-test, p-cpe:/a:oracle:linux:postgresql-plperl, p-cpe:/a:oracle:linux:postgresql-pltcl, p-cpe:/a:oracle:linux:postgresql-upgrade, p-cpe:/a:oracle:linux:postgresql-static, p-cpe:/a:oracle:linux:postgresql-plpython3, p-cpe:/a:oracle:linux:postgresql-server-devel, p-cpe:/a:oracle:linux:postgresql-test-rpm-macros, p-cpe:/a:oracle:linux:postgresql-upgrade-devel, p-cpe:/a:oracle:linux:pgaudit, p-cpe:/a:oracle:linux:postgres-decoderbufs, p-cpe:/a:oracle:linux:pg_repack, cpe:/o:oracle:linux:9, p-cpe:/a:oracle:linux:postgresql-private-devel, p-cpe:/a:oracle:linux:postgresql-private-libs, p-cpe:/a:oracle:linux:pgvector, p-cpe:/a:oracle:linux:postgis, p-cpe:/a:oracle:linux:postgis-client, p-cpe:/a:oracle:linux:postgis-docs, p-cpe:/a:oracle:linux:postgis-upgrade, p-cpe:/a:oracle:linux:postgis-utils

Required KB Items: Host/OracleLinux, Host/RedHat/release, Host/RedHat/rpm-list, Host/local_checks_enabled

Exploit Ease: No known exploits are available

Patch Publication Date: 7/7/2026

Vulnerability Publication Date: 5/14/2026

Reference Information

CVE: CVE-2026-6473, CVE-2026-6475, CVE-2026-6477, CVE-2026-6478

IAVB: 2026-B-0129