njs-0.9.9 version has been released, with a fix for heap buffer overflow vulnerability in js_fetch_proxy (CVE-2026-8711), featuring js_access, r.readRequestText() and friends, r.readRequestForm(), and jsVarNames().
Log in[skip ci] or [skip cd] (#9861).git_commit_sha when no commit is explicitly provided (#9865, closes #9204)..dmp files (#9869).next and disabled the stale LiteQueen template (#9884, #10006).follow-redirects in the realtime Docker package to 1.16.0 (#9690).phpseclib/phpseclib to 3.0.52 (#9952).POST /api/v1/services instead.Full Changelog: v4.0.0...v4.1.0
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.3.html]
Fixed in Postfix 3.8-3.11:
Bitrot: builds with musl libc broke, because they were using an obsolete NO_SNPRINTF code path that had not been updated for Claude Code findings.
Two fixes for a signed integer overshift condition (a left shift into the sign bit). This "works" on contemporary CPUs, but may break in the future. One reported by Kamil Frankowicz, and one by Robert Sayre.
Viktor Dukhovni fixed an 'uninitialized value' error in the 'collate.pl' script.
Fixed in Postfix 3.11:
You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.
RTSP
RTMP
HLS
WebRTC
RPI Camera
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18, and 14.23. This release fixes 11 security vulnerabilities and over 60 bugs reported over the last several months.
For the full list of changes, please review the release notes.
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are running PostgreSQL 14 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.
CREATE TYPE does not check multirange schema CREATE privilegeCVSS v3.1 Base Score: 5.4
Supported, Vulnerable Versions: 14 - 18.
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to
hijack other queries that use search_path to find user-defined types,
including extension-defined types. That is to say, the victim will execute
arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Integer wraparound in multiple PostgreSQL server features allows an application input provider to cause the server to undersize an allocation and write out-of-bounds. This results in a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.
timeofday() can disclose portions of server memoryCVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 14 - 18.
Externally-controlled format string in PostgreSQL timeofday() function allows
an attacker to retrieve portions of server memory, via crafted timezone zones.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Xint Code for reporting this problem.
pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choiceCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
allows an origin superuser to overwrite local files, e.g.
/var/lib/postgres/.bashrc, that hijack the operating system account. It will
remain the case that starting the server after these commands implicitly trusts
the origin superuser, due to features like shared_preload_libraries. Hence, the
attack has practical implications only if one takes relevant action between
these commands and server start, like moving the files to a different VM or
snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and
14.23 are affected.
The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu (pkugenuine(at)gmail(dot)com), Guannan Wang (wgnbuaa(at)gmail(dot)com), and Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.
pg_createsubscriber allows SQL injection via subscription nameCVSS v3.1 Base Score: 7.2
Supported, Vulnerable Versions: 17 - 18.
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with
pg_create_subscription rights to execute arbitrary SQL as a superuser. The
attack takes effect when pg_createsubscriber next runs. Within major versions
17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.
Versions before PostgreSQL 17 are unaffected.
The PostgreSQL project thanks Yu Kunpeng for reporting this problem.
libpq lo_* functions let server superuser overwrite client stack memoryCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
functions allows the server superuser to overwrite a client stack buffer with an
arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...)
stores arbitrary-length, server-determined data into a buffer of unspecified
size. Because both the \lo_export command in psql and pg_dump call
lo_read(), the server superuser can overwrite pg_dump or psql stack memory.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem.
CVSS v3.1 Base Score: 6.5
Supported, Vulnerable Versions: 14 - 18.
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Joe Conway for reporting this problem.
CVSS v3.1 Base Score: 7.5
Supported, Vulnerable Versions: 14 - 18.
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem.
pg_restore_attribute_stats accepts values that cause query planning to read past end of stats arrayCVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 18.
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts
array values of unmatched length, which causes query planning to read past end
of one array. This allows a table maintainer to infer memory values past that
array end. Within major version 18, minor versions before PostgreSQL 18.4 are
affected. Versions before PostgreSQL 18 are unaffected.
The PostgreSQL project thanks Jeroen Gui for reporting this problem.
refint allows stack buffer overflow and SQL injectionCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Stack buffer overflow in PostgreSQL module refint allows an unprivileged
database user to execute arbitrary code as the operating system user running the
database. A distinct attack is possible if the application declares a
user-controlled column as a refint cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows a
primary key update value provider to execute arbitrary SQL as the database user
performing the primary key update. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.
REFRESH PUBLICATION allows SQL injection via table nameCVSS v3.1 Base Score: 3.7
Supported, Vulnerable Versions: 16 - 18.
SQL injection in PostgreSQL logical replication
ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator
to execute arbitrary SQL with the subscription's publication-side credentials.
The attack takes effect at the next REFRESH PUBLICATION. Within major versions
16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are
affected. Versions before PostgreSQL 16 are unaffected.
The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this problem.
This update fixes over 60 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.
DEFERRABLE INITIALLY DEFERRED would behave as NOT DEFERRABLE
after being set to NOT ENFORCED status and then back to ENFORCED. If you
have a foreign key with this problem, after installing this update you can fix
it by setting it to NOT ENFORCED and then back to ENFORCED.ON t1.boolcol.INSERT ... ON CONFLICT works when EXCLUDED references a virtual
generated column.MERGE encounters a concurrently-updated
tuple in "repeatable read" or "serializable"
isolation modes.CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the
source table had one or more dropped columns.WITHOUT OVERLAPS to allow domains.multirange.array_agg(anyarray) executes in
parallel.pg_aios system view pid column show NULL instead of 0 when an
entry has no owning process.pg_stat_replication shows NULL lag even while replication
is active.GROUP BY.pg_basebackup and pg_verifybackup.pg_dumpall doesn't skip role grants with dangling grantor OIDs,
restoring the behavior before PostgreSQL 16. Emits a warning about missing
grantor if the source server is PostgreSQL 16 or later.pg_upgrade to use the correct protocol version when connecting to older
source servers.pg_overexplain when using the RANGE_TABLE option.postgres_fdw crash due to premature cleanup of a failed connection.This release also updates time zone data files to tzdata release 2026b, in which British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward (though this could change). There is also a historical correction for Moldova, which has used EU DST transition times since 2022.
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use pg_upgrade
in order to apply this update release; you may simply stop PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.
For more details, please see the release notes.
If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.
nginx-1.30.1 stable and nginx-1.31.0 mainline versions have been released, with fixes for HTTP/2 request injection vulnerability in the ngx_http_proxy_module (CVE-2026-42926), buffer overflow vulnerability in the ngx_http_rewrite_module (CVE-2026-42945), buffer overread vulnerabilities in the ngx_http_scgi_module and ngx_http_uwsgi_module (CVE-2026-42946), buffer overread vulnerability in the ngx_http_charset_module (CVE-2026-42934), address spoofing vulnerability in HTTP/3 (CVE-2026-40460), and use-after-free vulnerability in OCSP requests to resolver (CVE-2026-40701). Additionally, nginx-1.31.0 mainline version features support for HTTP forward proxy.
You can install pre-built binaries from https://repo.dovecot.org/
Docker images can be found at https://hub.docker.com/r/dovecot/dovecot
Please review https://doc.dovecot.org/2.4.4/installation/upgrade/2.3-to-2.4.html and https://doc.dovecot.org/2.4.4/installation/installation.html.
There are experimental features in 2.4, one is enabled with --enable-experimental-mail-utf8, and another with --enable-experimental-imap4rev2, and you also need to set mail_utf8_extensions=yes and imap4rev2_enabled=yes to enable them in config.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
is_ip_in_cidr expression function for CIDR matching.mail-auth to 0.9 (which bumps hickory-resolver to 0.26).hickory.null values fails.Failed instead of Error when the query returns no results.EAFNOSUPPORT error..well-known endpoints.RCPT before rewriting.dns-update crate):
MX and SRV records.subname for apex records instead of @, which the API rejects.TXT record content in double quotes (RFC 1035) to suppress dashboard warnings.calcard crate):
STATUS:CANCELLED mapping from VTODO to JSCalendar.PT0S.
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
AccountSettings object return invalidProperties.mail-parser panic with certain messages containing corrupted attachments.RCPT on checks.AddressBook/query fetches wrong resources.%EMAILADDRESS% when no email address is provided.
[An on-line version of this announcement will be available at https://www.postfix.org/announcements/postfix-3.11.2.html]
Fixed in Postfix 3.11:
Fixed in Postfix 3.10:
Fixed in Postfix 3.8, 3.9, 3.10:
For older Postfix versions, a buffer over-read patch is included at the end of this text.
Fixed in Postfix 3.8, 3.9, 3.10. 3.11:
You can find the updated Postfix source code at the mirrors listed at https://www.postfix.org/.
Buffer over-read patch for Postfix 2.3 .. 3.7:
--- /var/tmp/postfix-3.8.15/src/global/dsn_util.c 2006-01-07 20:28:37.000000000 -0500 +++ src/global/dsn_util.c 2026-05-01 16:59:50.961688175 -0400 @@ -155,5 +155,5 @@ strncpy(dp->dsn.data, cp, len); dp->dsn.data[len] = 0; - cp += len + 1; + cp += len; } else if ((len = dsn_valid(def_dsn)) > 0) { strncpy(dp->dsn.data, def_dsn, len);
The Asterisk Development Team would like to announce
the release of Certified asterisk-18.9-cert18.
The release artifacts are available for immediate download at
https://github.com/asterisk/asterisk/releases/tag/certified-18.9-cert18
and
https://downloads.asterisk.org/pub/telephony/certified-asterisk
Repository: https://github.com/asterisk/asterisk
Tag: certified-18.9-cert18
This release resolves issues reported by the community
and would have not been possible without your participation.
Thank You!
Author: Naveen Albert
Date: 2022-10-17
Some SIP devices use an empty extension for PLAR functionality.
Rather than rejecting these empty extensions, we now use the s
extension for such calls to mirror the existing PLAR functionality
in Asterisk (e.g. chan_dahdi).
ASTERISK-30265 #close
If you are upgrading from v0.16.x, replace the binary (or run docker pull). If you are upgrading from v0.15.x and below, please read the upgrading documentation for more information on how to upgrade from previous versions.
STALWART_HTTPS_PORT with STALWART_PUBLIC_URL.app_ instead of app to avoid issues with some clients that do not support spaces in passwords.INFO.
General
HLS
WebRTC
RPI Camera
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
HLS
General
API
RTSP
HLS
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
RTSP
RTMP
WebRTC
RPI Camera
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
WebRTC
API
General
API
RTSP
HLS
WebRTC
Dependencies
Binaries are compiled from source code by the Release workflow, which is a fully-visible process that prevents any change or external interference in produced artifacts.
Checksums of binaries are also published in a public blockchain by using GitHub Attestations, and they can be verified by running:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
HLS
Dependencies
Binaries are compiled from source code by the Release workflow without human intervention.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
API
RTMP
HLS
WebRTC
SRT
RPI Camera
Dependencies
Binaries are compiled from source code by the Release workflow without human intervention.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
RTSP
RPI Camera
Dependencies
Binaries are compiled from source code by the Release workflow without human intervention.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
API
WebRTC
General
API
RTSP
HLS
WebRTC
RPI Camera
Dependencies
Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
RTSP
SRT
Dependencies
Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
General
API
RTSP
RTMP
Dependencies
Binaries are compiled from source through the Release workflow without human intervention, preventing any external interference.
You can verify that binaries have been produced by the workflow by using GitHub Attestations:
ls mediamtx_* | xargs -L1 gh attestation verify --repo bluenviron/mediamtx
You can verify checksums of binaries by downloading checksums.sha256 and running:
cat checksums.sha256 | grep "$(ls mediamtx_*)" | sha256sum --check
