PostgreSQL security updates

Security-fix and disclosure events for PostgreSQL. Targets recurring searches like “PostgreSQL security updates” with timeline evidence — not a marketing changelog.

52 timeline events on record.

Sep 11, 2026
Revert "Support more object types within CREATE SCHEMA".
Confirmed security fix
Revert "Support more object types within CREATE SCHEMA". This reverts commit d516974840f4059d331ae6057ede3e4edd3c6747, along with parts of commit 049b742daad0965be4a846035408ae27ce1f9e14 ("psql: Tighten heuristics for BEGIN/END within CREATE SCHEMA"). While there's nothing par…
Open related record
Aug 10, 2026
Check for USAGE privilege on the composite type in ALTER TABLE OF.
Confirmed security fix
Check for USAGE privilege on the composite type in ALTER TABLE OF. This omission allowed roles without USAGE on a type to create tables that depend on it, which could prevent the owner from changing the type later. Reported-by: Nathan Bossart Author: Nathan Bossart Reviewed-by…
Open related record
Aug 10, 2026
Save/restore more lexer state when skipping text due to \if.
Confirmed security fix
Save/restore more lexer state when skipping text due to \if. When we implemented \if ... \endif in psql, we arranged to save/restore the lexer's parenthesis depth counter across any chunk of input that we're ignoring. At the time, that was sufficient, because no other part of P…
Open related record
Aug 10, 2026
psql: Don't do backquote expansion in \unrestrict.
Confirmed security fix
psql: Don't do backquote expansion in \unrestrict. This oversight in commit 71ea0d6795 allows a malicious server to inject shell commands into plain-text dump output that are run at restore time on the machine running psql. To fix, interpret all text after \unrestrict until the…
Open related record
Aug 10, 2026
Invalidate plan cache after role changes.
Confirmed security fix
Invalidate plan cache after role changes. Role membership, role attribute, and database ownership changes may impact the expected behavior of row-level security policies, but currently the plan cache doesn't take notice. To fix, register syscache callbacks on pg_auth_members, p…
Open related record
Aug 10, 2026
Fix out-of-bound reads with ascii() for invalid multibyte characters
Confirmed security fix
Fix out-of-bound reads with ascii() for invalid multibyte characters This commit addresses two defects in this SQL function, the code assuming that: - The user-supplied string was long enough to contain a character of the length implied by the first byte. It is possible to prov…
Open related record
Aug 10, 2026
Fix errorhandling for PGP encryption
Confirmed security fix
Fix errorhandling for PGP encryption PGP encryption was using px_cipher_encrypt without checking if any error was returned. When OpenSSL is running in FIPS mode, or when the legacy provider hasn't been loaded, not all ciphers which are supported by the PGP code are available an…
Open related record
Aug 10, 2026
Check for USAGE privilege on types used by stored expressions.
Confirmed security fix
Check for USAGE privilege on types used by stored expressions. This omission allowed roles without USAGE on a type to create stored expressions that depend on it, which could prevent the owner from changing the type later. The checks deliberately live in the command paths rath…
Open related record
Aug 10, 2026
pgcrypto: Add option to revert to prior decryption behavior
Confirmed security fix
pgcrypto: Add option to revert to prior decryption behavior The previous commit raises an ERROR during PGP operations if OpenSSL does not support the cipher in use. However, any existing messages created with faulty encryption will no longer be accessible via pgp_[sym|pub]_decr…
Open related record
Aug 10, 2026
Teach psql to skip in-line COPY ... FROM STDIN data after a failure.
Confirmed security fix
Teach psql to skip in-line COPY ... FROM STDIN data after a failure. If the COPY command fails before sending PGRES_COPY_IN, psql did not realize that it ought to consume any in-line data following the command. Failing to do so leads to trying to execute that data as SQL comman…
Open related record
Aug 10, 2026
Move SplitGUCList() to fe_utils
Confirmed security fix
Move SplitGUCList() to fe_utils This is needed so that all versions of pg_upgrade that migrate logical replication slots can parse the new output_plugin_libraries GUC. Backpatch-through: 17 Security: CVE-2026-6471
Open related record
Aug 10, 2026
Use palloc_array() in pltcl and plperl to avoid overflow
Confirmed security fix
Use palloc_array() in pltcl and plperl to avoid overflow Some of these could overflow on 32-bit systems with the right input. Convert all cases where we called palloc() with multiplication to fix them. Not all of them were bugs, but it's better to be safe than sorry. Reported-…
Open related record
Aug 10, 2026
Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE.
Confirmed security fix
Check for USAGE privilege on the subtype in CREATE TYPE AS RANGE. This omission allowed roles without USAGE on a type to create range types that depend on it, which could prevent the owner from changing the type later. Reported-by: Jingzhou Fu Author: Nathan Bossart Reviewed-b…
Open related record
Aug 10, 2026
ecpg: Fix out-of-bound writes due to processing of invalid bytea data
Confirmed security fix
ecpg: Fix out-of-bound writes due to processing of invalid bytea data ECPG assumes that any bytea data it receives from a backend starts with '\x' as its first two bytes, but a check was missed to enforce that. A rogue server sending some garbage bytea data would be able to cra…
Open related record
Aug 10, 2026
Obstruct EXTRACT() field name deparse injection.
Confirmed security fix
Obstruct EXTRACT() field name deparse injection. The parser accepts any string as an EXTRACT() field name, but deparsing does not quote and escape it accordingly. To fix, quote and escape the field name during deparsing as needed. It might be a good idea to validate the field n…
Open related record
Aug 10, 2026
Use value of scram_iterations in mock_scram_secret().
Confirmed security fix
Use value of scram_iterations in mock_scram_secret(). Presently, mock_scram_secret() always uses SCRAM_SHA_256_DEFAULT_ITERATIONS, which poses an observable response discrepancy hazard when scram_iterations is set to something else. To fix, use the value of the configuration pa…
Open related record
Aug 10, 2026
Empty search_path in amcheck.
Confirmed security fix
Empty search_path in amcheck. A grantee of amcheck function EXECUTE privilege could execute arbitrary functions as the owners of expression indexes that depend on the search path. An expression like (lower(col)) was not vulnerable, because lower() is resolved at CREATE INDEX ti…
Open related record
Aug 10, 2026
Reject GSSEncRequest after direct SSL connection
Confirmed security fix
Reject GSSEncRequest after direct SSL connection When a direct SSL connection was established, ProcessStartupPacket() still accepted GSSEncRequest messages. The GSSAPI negotiation would then use raw writes and reads, bypassing the TLS encryption layer. After the GSS encryption…
Open related record
Aug 10, 2026
Avoid overflow in Levenshtein distance calculations.
Confirmed security fix
Avoid overflow in Levenshtein distance calculations. levenshtein() and levenshtein_less_equal() let the caller specify the insertion, deletion, and substitution costs, and fuzzystrmatch's corresponding SQL functions accept any 32-bit integer for each. Since the distances are ca…
Open related record
Aug 10, 2026
Cross-check the type of a portal running EXECUTE or FETCH.
Confirmed security fix
Cross-check the type of a portal running EXECUTE or FETCH. When an EXECUTE or FETCH statement is executed, there are two portals: an outer portal that is created for the EXECUTE or FETCH statement itself, and an inner portal for the statement being executed on its behalf. Befor…
Open related record
Feb 9, 2026
Harden _int_matchsel() against being attached to the wrong operator.
Confirmed security fix
Harden _int_matchsel() against being attached to the wrong operator. While the preceding commit prevented such attachments from occurring in future, this one aims to prevent further abuse of any already- created operator that exposes _int_matchsel to the wrong data types. (No o…
Open related record
Nov 10, 2025
Check for CREATE privilege on the schema in CREATE STATISTICS.
Confirmed security fix
Check for CREATE privilege on the schema in CREATE STATISTICS. This omission allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts. For ALTER TABLE commands that require re-creating statistics objects, skip this check in cas…
Open related record
Nov 10, 2025
libpq: Prevent some overflows of int/size_t
Confirmed security fix
libpq: Prevent some overflows of int/size_t Several functions could overflow their size calculations, when presented with very large inputs from remote and/or untrusted locations, and then allocate buffers that were too small to hold the intended contents. Switch from int to s…
Open related record
Aug 11, 2025
Fix security checks in selectivity estimation functions.
Confirmed security fix
Fix security checks in selectivity estimation functions. Commit e2d4ef8de86 (the fix for CVE-2017-7484) added security checks to the selectivity estimation functions to prevent them from running user-supplied operators on data obtained from pg_statistic if the user lacks privil…
Open related record
Aug 11, 2025
Restrict psql meta-commands in plain-text dumps.
Confirmed security fix
Restrict psql meta-commands in plain-text dumps. A malicious server could inject psql meta-commands into plain-text dump output (i.e., scripts created with pg_dump --format=plain, pg_dumpall, or pg_restore --file) that are run at restore time on the machine running psql. To fix…
Open related record
Aug 11, 2025
Convert newlines to spaces in names written in v11+ pg_dump comments.
Confirmed security fix
Convert newlines to spaces in names written in v11+ pg_dump comments. Maliciously-crafted object names could achieve SQL injection during restore. CVE-2012-0868 fixed this class of problem at the time, but later work reintroduced three cases. Commit bc8cd50fefd369b217f80078585c…
Open related record
Jun 25, 2025
Restrict virtual columns to use built-in functions and types
Confirmed security fix
Restrict virtual columns to use built-in functions and types Just like selecting from a view is exploitable (CVE-2024-7348), selecting from a table with virtual generated columns is exploitable. Users who are concerned about this can avoid selecting from views, but telling them…
Open related record
May 5, 2025
Refactor test_escape.c for additional ways of testing.
Confirmed security fix
Refactor test_escape.c for additional ways of testing. Start the file with static functions not specific to pe_test_vectors tests. This way, new tests can use them without disrupting the file's layout. Change report_result() PQExpBuffer arguments to plain strings. Back-patch to…
Open related record
May 5, 2025
With GB18030, prevent SIGSEGV from reading past end of allocation.
Confirmed security fix
With GB18030, prevent SIGSEGV from reading past end of allocation. With GB18030 as source encoding, applications could crash the server via SQL functions convert() or convert_from(). Applications themselves could crash after passing unterminated GB18030 input to libpq functions…
Open related record
Feb 16, 2025
In fmtIdEnc(), handle failure of enlargePQExpBuffer().
Confirmed security fix
In fmtIdEnc(), handle failure of enlargePQExpBuffer(). Coverity complained that we weren't doing that, and it's right. This fix just makes fmtIdEnc() honor the general convention that OOM causes a PQExpBuffer to become marked "broken", without any immediate error. In the prett…
Open related record
Feb 15, 2025
Make escaping functions retain trailing bytes of an invalid character.
Confirmed security fix
Make escaping functions retain trailing bytes of an invalid character. Instead of dropping the trailing byte(s) of an invalid or incomplete multibyte character, replace only the first byte with a known-invalid sequence, and process the rest normally. This seems less likely to c…
Open related record
Feb 10, 2025
Adapt appendPsqlMetaConnect() to the new fmtId() encoding expectations.
Confirmed security fix
Adapt appendPsqlMetaConnect() to the new fmtId() encoding expectations. We need to tell fmtId() what encoding to assume, but this function doesn't know that. Fortunately we can fix that without changing the function's API, because we can just use SQL_ASCII. That's because datab…
Open related record
Feb 10, 2025
Fix type in test_escape test
Confirmed security fix
Fix type in test_escape test On machines where char is unsigned this could lead to option parsing looping endlessly. It's also too narrow a type on other hardware. Found via Tom Lane's monitoring of the buildfarm. Reported-by: Tom Lane Security: CVE-2025-1094 Backpatch-throug…
Open related record
Feb 10, 2025
docs: EUC_TW can be up to four bytes wide, not three
Confirmed security fix
docs: EUC_TW can be up to four bytes wide, not three Backpatch-through: 13 Security: CVE-2025-1094
Open related record
Feb 10, 2025
Specify the encoding of input to fmtId()
Confirmed security fix
Specify the encoding of input to fmtId() This commit adds fmtIdEnc() and fmtQualifiedIdEnc(), which allow to specify the encoding as an explicit argument. Additionally setFmtEncoding() is provided, which defines the encoding when no explicit encoding is provided, to avoid break…
Open related record
Feb 10, 2025
Add test of various escape functions
Confirmed security fix
Add test of various escape functions As highlighted by the prior commit, writing correct escape functions is less trivial than one might hope. This test module tries to verify that different escaping functions behave reasonably. It e.g. tests: - Invalidly encoded input to an…
Open related record
Feb 10, 2025
Fix handling of invalidly encoded data in escaping functions
Confirmed security fix
Fix handling of invalidly encoded data in escaping functions Previously invalidly encoded input to various escaping functions could lead to the escaped string getting incorrectly parsed by psql. To be safe, escaping functions need to ensure that neither invalid nor incomplete m…
Open related record
Feb 10, 2025
Add pg_encoding_set_invalid()
Confirmed security fix
Add pg_encoding_set_invalid() There are cases where we cannot / do not want to error out for invalidly encoded input. In such cases it can be useful to replace e.g. an incomplete multi-byte characters with bytes that will trigger an error when getting validated as part of a lar…
Open related record
Dec 28, 2024
Exclude parallel workers from connection privilege/limit checks.
Confirmed security fix
Exclude parallel workers from connection privilege/limit checks. Cause parallel workers to not check datallowconn, rolcanlogin, and ACL_CONNECT privileges. The leader already checked these things (except for rolcanlogin which might have been checked for a different role). Re-ch…
Open related record
Nov 16, 2024
Fix per-session activation of ALTER {ROLE|DATABASE} SET role.
Confirmed security fix
Fix per-session activation of ALTER {ROLE|DATABASE} SET role. After commit 5a2fed911a85ed6d8a015a6bafe3a0d9a69334ae, the catalog state resulting from these commands ceased to affect sessions. Restore the longstanding behavior, which is like beginning the session with a SET ROLE…
Open related record