The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18, and 14.23. This release fixes 11 security vulnerabilities and over 60 bugs reported over the last several months.
For the full list of changes, please review the release notes.
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are running PostgreSQL 14 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.
CREATE TYPE does not check multirange schema CREATE privilegeCVSS v3.1 Base Score: 5.4
Supported, Vulnerable Versions: 14 - 18.
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to
hijack other queries that use search_path to find user-defined types,
including extension-defined types. That is to say, the victim will execute
arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Integer wraparound in multiple PostgreSQL server features allows an application input provider to cause the server to undersize an allocation and write out-of-bounds. This results in a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.
timeofday() can disclose portions of server memoryCVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 14 - 18.
Externally-controlled format string in PostgreSQL timeofday() function allows
an attacker to retrieve portions of server memory, via crafted timezone zones.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Xint Code for reporting this problem.
pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choiceCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind
allows an origin superuser to overwrite local files, e.g.
/var/lib/postgres/.bashrc, that hijack the operating system account. It will
remain the case that starting the server after these commands implicitly trusts
the origin superuser, due to features like shared_preload_libraries. Hence, the
attack has practical implications only if one takes relevant action between
these commands and server start, like moving the files to a different VM or
snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and
14.23 are affected.
The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu (pkugenuine(at)gmail(dot)com), Guannan Wang (wgnbuaa(at)gmail(dot)com), and Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.
pg_createsubscriber allows SQL injection via subscription nameCVSS v3.1 Base Score: 7.2
Supported, Vulnerable Versions: 17 - 18.
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with
pg_create_subscription rights to execute arbitrary SQL as a superuser. The
attack takes effect when pg_createsubscriber next runs. Within major versions
17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.
Versions before PostgreSQL 17 are unaffected.
The PostgreSQL project thanks Yu Kunpeng for reporting this problem.
libpq lo_* functions let server superuser overwrite client stack memoryCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in
PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64()
functions allows the server superuser to overwrite a client stack buffer with an
arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...)
stores arbitrary-length, server-determined data into a buffer of unspecified
size. Because both the \lo_export command in psql and pg_dump call
lo_read(), the server superuser can overwrite pg_dump or psql stack memory.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem.
CVSS v3.1 Base Score: 6.5
Supported, Vulnerable Versions: 14 - 18.
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Joe Conway for reporting this problem.
CVSS v3.1 Base Score: 7.5
Supported, Vulnerable Versions: 14 - 18.
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem.
pg_restore_attribute_stats accepts values that cause query planning to read past end of stats arrayCVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 18.
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts
array values of unmatched length, which causes query planning to read past end
of one array. This allows a table maintainer to infer memory values past that
array end. Within major version 18, minor versions before PostgreSQL 18.4 are
affected. Versions before PostgreSQL 18 are unaffected.
The PostgreSQL project thanks Jeroen Gui for reporting this problem.
refint allows stack buffer overflow and SQL injectionCVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Stack buffer overflow in PostgreSQL module refint allows an unprivileged
database user to execute arbitrary code as the operating system user running the
database. A distinct attack is possible if the application declares a
user-controlled column as a refint cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows a
primary key update value provider to execute arbitrary SQL as the database user
performing the primary key update. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.
The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.
REFRESH PUBLICATION allows SQL injection via table nameCVSS v3.1 Base Score: 3.7
Supported, Vulnerable Versions: 16 - 18.
SQL injection in PostgreSQL logical replication
ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator
to execute arbitrary SQL with the subscription's publication-side credentials.
The attack takes effect at the next REFRESH PUBLICATION. Within major versions
16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are
affected. Versions before PostgreSQL 16 are unaffected.
The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this problem.
This update fixes over 60 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.
DEFERRABLE INITIALLY DEFERRED would behave as NOT DEFERRABLE
after being set to NOT ENFORCED status and then back to ENFORCED. If you
have a foreign key with this problem, after installing this update you can fix
it by setting it to NOT ENFORCED and then back to ENFORCED.ON t1.boolcol.INSERT ... ON CONFLICT works when EXCLUDED references a virtual
generated column.MERGE encounters a concurrently-updated
tuple in "repeatable read" or "serializable"
isolation modes.CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the
source table had one or more dropped columns.WITHOUT OVERLAPS to allow domains.multirange.array_agg(anyarray) executes in
parallel.pg_aios system view pid column show NULL instead of 0 when an
entry has no owning process.pg_stat_replication shows NULL lag even while replication
is active.GROUP BY.pg_basebackup and pg_verifybackup.pg_dumpall doesn't skip role grants with dangling grantor OIDs,
restoring the behavior before PostgreSQL 16. Emits a warning about missing
grantor if the source server is PostgreSQL 16 or later.pg_upgrade to use the correct protocol version when connecting to older
source servers.pg_overexplain when using the RANGE_TABLE option.postgres_fdw crash due to premature cleanup of a failed connection.This release also updates time zone data files to tzdata release 2026b, in which British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward (though this could change). There is also a historical correction for Moldova, which has used EU DST transition times since 2022.
All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use pg_upgrade
in order to apply this update release; you may simply stop PostgreSQL and
update its binaries.
Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.
For more details, please see the release notes.
If you have corrections or suggestions for this release announcement, please send them to the pgsql-www@lists.postgresql.org public mailing list.