The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18, and 14.23.
This release fixes 11 security vulnerabilities and over 60 bugs reported
over the last several months.
For the full list of changes, please review the release
notes.
PostgreSQL 14 EOL Notice
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you make
plans to upgrade to a newer, supported version of PostgreSQL. Please see our
versioning policy for more
information.
Security Issues
CVE-2026-6472: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege
CVSS v3.1 Base Score: 5.4
Supported, Vulnerable Versions: 14 - 18.
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to
hijack other queries that use search_path to find user-defined types,
including extension-defined types. That is to say, the victim will execute
arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.
CVE-2026-6473: PostgreSQL server undersizes allocations, via integer wraparound
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Integer wraparound in multiple PostgreSQL server features allows an application
input provider to cause the server to undersize an allocation and write
out-of-bounds. This results in a segmentation fault. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu,
Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and
Sven Klemm for reporting this problem.
CVE-2026-6474: PostgreSQL timeofday() can disclose portions of server memory
CVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 14 - 18.
Externally-controlled format string in PostgreSQL timeofday() function allows
an attacker to retrieve portions of server memory, via crafted timezone zones.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Xint Code for reporting this problem.
CVE-2026-6475: PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
allows an origin superuser to overwrite local files, e.g.
/var/lib/postgres/.bashrc, that hijack the operating system account. It will
remain the case that starting the server after these commands implicitly trusts
the origin superuser, due to features like shared_preload_libraries. Hence, the
attack has practical implications only if one takes relevant action between
these commands and server start, like moving the files to a different VM or
snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and
14.23 are affected.
The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab,
Atuin Automated Vulnerability Discovery Engine,
Zhanpeng Liu (pkugenuine(at)gmail(dot)com),
Guannan Wang (wgnbuaa(at)gmail(dot)com), and
Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.
CVE-2026-6476: PostgreSQL pg_createsubscriber allows SQL injection via subscription name
CVSS v3.1 Base Score: 7.2
Supported, Vulnerable Versions: 17 - 18.
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with
pg_create_subscription rights to execute arbitrary SQL as a superuser. The
attack takes effect when pg_createsubscriber next runs. Within major versions
17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.
Versions before PostgreSQL 17 are unaffected.
The PostgreSQL project thanks Yu Kunpeng for reporting this problem.
CVE-2026-6477: PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
functions allows the server superuser to overwrite a client stack buffer with an
arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...)
stores arbitrary-length, server-determined data into a buffer of unspecified
size. Because both the \lo_export command in psql and pg_dump call
lo_read(), the server superuser can overwrite pg_dump or psql stack memory.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting
this problem.
CVE-2026-6478: PostgreSQL discloses MD5-hashed passwords via covert timing channel
CVSS v3.1 Base Score: 6.5
Supported, Vulnerable Versions: 14 - 18.
Covert timing channel in comparison of MD5-hashed password in PostgreSQL
authentication allows an attacker to recover user credentials sufficient to
authenticate. This does not affect scram-sha-256 passwords, the default in all
supported releases. However, current databases may have MD5-hashed passwords
originating in upgrades from PostgreSQL 13 or earlier. Versions before
PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Joe Conway for reporting this problem.
CVE-2026-6479: PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion
CVSS v3.1 Base Score: 7.5
Supported, Vulnerable Versions: 14 - 18.
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker
able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of
service. If SSL and GSS are both disabled, an attacker can do the same via
access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Calif.io in collaboration with Claude and
Anthropic Research for reporting this problem.
CVE-2026-6575: PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array
CVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 18.
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts
array values of unmatched length, which causes query planning to read past end
of one array. This allows a table maintainer to infer memory values past that
array end. Within major version 18, minor versions before PostgreSQL 18.4 are
affected. Versions before PostgreSQL 18 are unaffected.
The PostgreSQL project thanks Jeroen Gui for reporting this problem.
CVE-2026-6637: PostgreSQL refint allows stack buffer overflow and SQL injection
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Stack buffer overflow in PostgreSQL module refint allows an unprivileged
database user to execute arbitrary code as the operating system user running the
database. A distinct attack is possible if the application declares a
user-controlled column as a refint cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows a
primary key update value provider to execute arbitrary SQL as the database user
performing the primary key update. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.
CVE-2026-6638: PostgreSQL REFRESH PUBLICATION allows SQL injection via table name
CVSS v3.1 Base Score: 3.7
Supported, Vulnerable Versions: 16 - 18.
SQL injection in PostgreSQL logical replication
ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator
to execute arbitrary SQL with the subscription's publication-side credentials.
The attack takes effect at the next REFRESH PUBLICATION. Within major versions
16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are
affected. Versions before PostgreSQL 16 are unaffected.
The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this
problem.
Bug Fixes and Improvements
This update fixes over 60 bugs that were reported in the last several
months. The issues listed below affect PostgreSQL 18. Some of these issues may
also affect other supported versions of PostgreSQL.
- Fix queries that could return incorrect results when using a nondeterministic
collation over a unique index.
- Fix loss of deferrability of foreign-key triggers. Previously, a foreign key
defined as
DEFERRABLE INITIALLY DEFERRED would behave as NOT DEFERRABLE
after being set to NOT ENFORCED status and then back to ENFORCED. If you
have a foreign key with this problem, after installing this update you can fix
it by setting it to NOT ENFORCED and then back to ENFORCED.
- Improve the planner's ability to apply partition pruning to more cases.
- Fix self-join removal to handle join clauses that are only boolean columns,
for example,
ON t1.boolcol.
- Several fixes around virtual generated columns, including ensuring
INSERT ... ON CONFLICT works when EXCLUDED references a virtual
generated column.
- Report a serialization failure when
MERGE encounters a concurrently-updated
tuple in "repeatable read" or "serializable"
isolation modes.
- Fix
CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the
source table had one or more dropped columns.
- Fix
WITHOUT OVERLAPS to allow domains.
- Disallow making a composite type be a member of itself via a
multirange.
- Fix sometimes-incorrect results when
array_agg(anyarray) executes in
parallel.
- Prevent bloating during restore of an incremental backup.
- Prevent stuck logical replication slot synchronization worker processes from
blocking promotion of a standby server.
- Make the
pg_aios system view pid column show NULL instead of 0 when an
entry has no owning process.
- Fix cases where
pg_stat_replication shows NULL lag even while replication
is active.
- Correctly display JOIN alias variables that are used in
GROUP BY.
- If the startup process fails, properly shut down other child processes before
exiting the postmaster.
- Fix race condition that could cause a standby server following WAL from a
primary of an older minor version to get into a crash-and-restart loop.
- Prevent indefinite wait in shutdown of a walsender process when logical
replication is actively publishing data.
- Ensure that free space map changes are persisted during recovery. This could
have performance ramifications on a standby server after promotion.
- Fix assorted bugs in backup decompression and tar-parsing code used in
pg_basebackup and pg_verifybackup.
- Ensure
pg_dumpall doesn't skip role grants with dangling grantor OIDs,
restoring the behavior before PostgreSQL 16. Emits a warning about missing
grantor if the source server is PostgreSQL 16 or later.
- Fix
pg_upgrade to use the correct protocol version when connecting to older
source servers.
- Fix output in
pg_overexplain when using the RANGE_TABLE option.
- Fix
postgres_fdw crash due to premature cleanup of a failed connection.
This release also updates time zone data files to tzdata release 2026b, in which
British Columbia (America/Vancouver) will be on year-round UTC-07
(effectively, permanent DST) beginning in November 2026. This release assumes
that their TZ abbreviation will be MST from that time forward (though this
could change). There is also a historical correction for Moldova, which has used
EU DST transition times since 2022.
Updating
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use pg_upgrade
in order to apply this update release; you may simply stop PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional
post-update steps; please see the release notes from earlier versions for
details.
For more details, please see the release notes.
Links
If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.
Log in
