PostgreSQL security fix timeline
Public commits from postgres/postgres whose messages cite a vulnerability or a security fix. Patch text is not stored.
58 security-fix timeline events
Aug 10, 2026 · CVE-2026-6471
Move SplitGUCList() to fe_utils
Move SplitGUCList() to fe_utils This is needed so that all versions of pg_upgrade that migrate logical replication slots can parse the new output_plugin_libraries GUC. Backpatch-through: 17 Security: CVE-2026-6471
Aug 10, 2026 · CVE-2026-14677
Use palloc_array() in pltcl and plperl to avoid overflow
Use palloc_array() in pltcl and plperl to avoid overflow Some of these could overflow on 32-bit systems with the right input. Convert all cases where we called palloc() with multiplication to fix them. Not all of them were bugs, but it's better to be safe than sorry. Reported-…
Aug 10, 2026 · CVE-2026-6470
Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE.
Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE. This omission allowed roles without USAGE on a type to create range types that depend on it, which could prevent the owner from changing the type later. Reported-by: Jingzhou Fu <fuboat@outlook.com> Author: Nath…
Aug 10, 2026 · CVE-2026-16241
ecpg: Fix out-of-bound writes due to processing of invalid bytea data
ecpg: Fix out-of-bound writes due to processing of invalid bytea data ECPG assumes that any bytea data it receives from a backend starts with '\x' as its first two bytes, but a check was missed to enforce that. A rogue server sending some garbage bytea data would be able to cr…
Aug 10, 2026 · CVE-2026-15741
Obstruct EXTRACT() field name deparse injection.
Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field…
Aug 10, 2026 · CVE-2026-14672
Use value of scram_iterations in mock_scram_secret().
Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration p…
Aug 10, 2026 · CVE-2018-1058
Empty search_path in amcheck.
Empty search_path in amcheck. A grantee of amcheck function EXECUTE privilege could execute arbitrary functions as the owners of expression indexes that depend on the search path. An expression like (lower(col)) was not vulnerable, because lower() is resolved at CREATE INDEX t…
Aug 10, 2026 · CVE-2026-14681
Reject GSSEncRequest after direct SSL connection
Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption…
Aug 10, 2026 · CVE-2026-15742
Avoid overflow in Levenshtein distance calculations.
Avoid overflow in Levenshtein distance calculations. levenshtein() and levenshtein_less_equal() let the caller specify the insertion, deletion, and substitution costs, and fuzzystrmatch's corresponding SQL functions accept any 32-bit integer for each. Since the distances are c…
Aug 10, 2026 · CVE-2026-16239
Cross-check the type of a portal running EXECUTE or FETCH.
Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Befor…