PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 Released!

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18, and 14.23.
This release fixes 11 security vulnerabilities and over 60 bugs reported
over the last several months.

For the full list of changes, please review the [release
notes](https://www.postgresql.org/docs/release/).

PostgreSQL 14 EOL Notice
------------------------

PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you make
plans to upgrade to a newer, supported version of PostgreSQL. Please see our
[versioning policy](https://www.postgresql.org/support/versioning/) for more
information.

Security Issues
---------------

### [CVE-2026-6472](https://www.postgresql.org/support/security/CVE-2026-6472/): PostgreSQL `CREATE TYPE` does not check `multirange` schema `CREATE` privilege

CVSS v3.1 Base Score: [5.4](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Supported, Vulnerable Versions: 14 - 18.

Missing authorization in PostgreSQL `CREATE TYPE` allows an object creator to
hijack other queries that use `search_path` to find user-defined types,
including extension-defined types. That is to say, the victim will execute
arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.

### [CVE-2026-6473](https://www.postgresql.org/support/security/CVE-2026-6473/): PostgreSQL server undersizes allocations, via integer wraparound

CVSS v3.1 Base Score: [8.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Supported, Vulnerable Versions: 14 - 18.

Integer wraparound in multiple PostgreSQL server features allows an application
input provider to cause the server to undersize an allocation and write
out-of-bounds. This results in a segmentation fault. Versions before PostgreSQL
18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu,
Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and
Sven Klemm for reporting this problem.

### [CVE-2026-6474](https://www.postgresql.org/support/security/CVE-2026-6474/): PostgreSQL `timeofday()` can disclose portions of server memory

CVSS v3.1 Base Score: [4.3](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Supported, Vulnerable Versions: 14 - 18.

Externally-controlled format string in PostgreSQL `timeofday()` function allows
an attacker to retrieve portions of server memory, via crafted timezone zones.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Xint Code for reporting this problem.

### [CVE-2026-6475](https://www.postgresql.org/support/security/CVE-2026-6475/): PostgreSQL `pg_basebackup` and `pg_rewind` can overwrite unrelated files of origin superuser choice

CVSS v3.1 Base Score: [8.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Supported, Vulnerable Versions: 14 - 18.

Symlink following in PostgreSQL `pg_basebackup` plain format and in `pg_rewind`
allows an origin superuser to overwrite local files, e.g.
`/var/lib/postgres/.bashrc`, that hijack the operating system account. It will
remain the case that starting the server after these commands implicitly trusts
the origin superuser, due to features like shared_preload_libraries. Hence, the
attack has practical implications only if one takes relevant action between
these commands and server start, like moving the files to a different VM or
snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and
14.23 are affected.

The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab,
Atuin Automated Vulnerability Discovery Engine,
Zhanpeng Liu (pkugenuine(at)gmail(dot)com),
Guannan Wang (wgnbuaa(at)gmail(dot)com), and
Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.

### [CVE-2026-6476](https://www.postgresql.org/support/security/CVE-2026-6476/): PostgreSQL `pg_createsubscriber` allows SQL injection via subscription name

CVSS v3.1 Base Score: [7.2](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Supported, Vulnerable Versions: 17 - 18.

SQL injection in PostgreSQL `pg_createsubscriber` allows an attacker with
`pg_create_subscription` rights to execute arbitrary SQL as a superuser. The
attack takes effect when `pg_createsubscriber` next runs. Within major versions
17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.
Versions before PostgreSQL 17 are unaffected.

The PostgreSQL project thanks Yu Kunpeng for reporting this problem.

### [CVE-2026-6477](https://www.postgresql.org/support/security/CVE-2026-6477/): PostgreSQL `libpq` lo_* functions let server superuser overwrite client stack memory

CVSS v3.1 Base Score: [8.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Supported, Vulnerable Versions: 14 - 18.

Use of inherently dangerous function `PQfn(..., result_is_int=0, ...)` in
PostgreSQL libpq `lo_export()`, `lo_read()`, `lo_lseek64()`, and `lo_tell64()`
functions allows the server superuser to overwrite a client stack buffer with an
arbitrarily-large response. Like `gets()`, `PQfn(..., result_is_int=0, ...)`
stores arbitrary-length, server-determined data into a buffer of unspecified
size. Because both the `\lo_export` command in `psql` and `pg_dump` call
`lo_read()`, the server superuser can overwrite pg_dump or psql stack memory.
Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting
this problem.

### [CVE-2026-6478](https://www.postgresql.org/support/security/CVE-2026-6478/): PostgreSQL discloses MD5-hashed passwords via covert timing channel

CVSS v3.1 Base Score: [6.5](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)

Supported, Vulnerable Versions: 14 - 18.

Covert timing channel in comparison of MD5-hashed password in PostgreSQL
authentication allows an attacker to recover user credentials sufficient to
authenticate. This does not affect scram-sha-256 passwords, the default in all
supported releases. However, current databases may have MD5-hashed passwords
originating in upgrades from PostgreSQL 13 or earlier. Versions before
PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Joe Conway for reporting this problem.

### [CVE-2026-6479](https://www.postgresql.org/support/security/CVE-2026-6479/): PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

CVSS v3.1 Base Score: [7.5](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Supported, Vulnerable Versions: 14 - 18.

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker
able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of
service. If SSL and GSS are both disabled, an attacker can do the same via
access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Calif.io in collaboration with Claude and
Anthropic Research for reporting this problem.

### [CVE-2026-6575](https://www.postgresql.org/support/security/CVE-2026-6575/): PostgreSQL `pg_restore_attribute_stats` accepts values that cause query planning to read past end of stats array

CVSS v3.1 Base Score: [4.3](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Supported, Vulnerable Versions: 18.

Buffer over-read in PostgreSQL function `pg_restore_attribute_stats()` accepts
array values of unmatched length, which causes query planning to read past end
of one array. This allows a table maintainer to infer memory values past that
array end. Within major version 18, minor versions before PostgreSQL 18.4 are
affected. Versions before PostgreSQL 18 are unaffected.

The PostgreSQL project thanks Jeroen Gui for reporting this problem.

### [CVE-2026-6637](https://www.postgresql.org/support/security/CVE-2026-6637/): PostgreSQL `refint` allows stack buffer overflow and SQL injection

CVSS v3.1 Base Score: [8.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Supported, Vulnerable Versions: 14 - 18.

Stack buffer overflow in PostgreSQL module `refint` allows an unprivileged
database user to execute arbitrary code as the operating system user running the
database. A distinct attack is possible if the application declares a
user-controlled column as a `refint` cascade primary key and facilitates
user-controlled updates to that column. In that case, a SQL injection allows a
primary key update value provider to execute arbitrary SQL as the database user
performing the primary key update. Versions before PostgreSQL 18.4, 17.10,
16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.

### [CVE-2026-6638](https://www.postgresql.org/support/security/CVE-2026-6638/): PostgreSQL `REFRESH PUBLICATION` allows SQL injection via table name

CVSS v3.1 Base Score: [3.7](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N)

Supported, Vulnerable Versions: 16 - 18.

SQL injection in PostgreSQL logical replication
`ALTER SUBSCRIPTION ... REFRESH PUBLICATION` allows a subscriber table creator
to execute arbitrary SQL with the subscription's publication-side credentials.
The attack takes effect at the next `REFRESH PUBLICATION`. Within major versions
16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are
affected. Versions before PostgreSQL 16 are unaffected.

The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this
problem.

Bug Fixes and Improvements
--------------------------

This update fixes over 60 bugs that were reported in the last several
months. The issues listed below affect PostgreSQL 18. Some of these issues may
also affect other supported versions of PostgreSQL.

* Fix queries that could return incorrect results when using a nondeterministic
collation over a unique index.
* Fix loss of deferrability of foreign-key triggers. Previously, a foreign key
defined as `DEFERRABLE INITIALLY DEFERRED` would behave as `NOT DEFERRABLE`
after being set to `NOT ENFORCED` status and then back to `ENFORCED`. If you
have a foreign key with this problem, after installing this update you can fix
it by setting it to `NOT ENFORCED` and then back to `ENFORCED`.
* Improve the planner's ability to apply partition pruning to more cases.
* Fix self-join removal to handle join clauses that are only boolean columns,
for example, `ON t1.boolcol`.
* Several fixes around virtual generated columns, including ensuring
`INSERT ... ON CONFLICT` works when `EXCLUDED` references a virtual
generated column.
* Report a serialization failure when `MERGE` encounters a concurrently-updated
tuple in "repeatable read" or "serializable"
[isolation modes](https://www.postgresql.org/docs/current/transaction-iso.html).
* Fix `CREATE TABLE ... LIKE ... INCLUDING STATISTICS` for cases where the
source table had one or more dropped columns.
* Fix `WITHOUT OVERLAPS` to allow domains.
* Disallow making a composite type be a member of itself via a `multirange`.
* Fix sometimes-incorrect results when `array_agg(anyarray)` executes in
parallel.
* Prevent bloating during restore of an incremental backup.
* Prevent stuck logical replication slot synchronization worker processes from
blocking promotion of a standby server.
* Make the `pg_aios` system view `pid` column show `NULL` instead of `0` when an
entry has no owning process.
* Fix cases where `pg_stat_replication` shows `NULL` lag even while replication
is active.
* Correctly display JOIN alias variables that are used in `GROUP BY`.
* If the startup process fails, properly shut down other child processes before
exiting the postmaster.
* Fix race condition that could cause a standby server following WAL from a
primary of an older minor version to get into a crash-and-restart loop.
* Prevent indefinite wait in shutdown of a walsender process when logical
replication is actively publishing data.
* Ensure that free space map changes are persisted during recovery. This could
have performance ramifications on a standby server after promotion.
* Fix assorted bugs in backup decompression and tar-parsing code used in
`pg_basebackup` and `pg_verifybackup`.
* Ensure `pg_dumpall` doesn't skip role grants with dangling grantor OIDs,
restoring the behavior before PostgreSQL 16. Emits a warning about missing
grantor if the source server is PostgreSQL 16 or later.
* Fix `pg_upgrade` to use the correct protocol version when connecting to older
source servers.
* Fix output in `pg_overexplain` when using the `RANGE_TABLE` option.
* Fix `postgres_fdw` crash due to premature cleanup of a failed connection.

This release also updates time zone data files to tzdata release 2026b, in which
British Columbia (America/Vancouver) will be on year-round UTC-07
(effectively, permanent DST) beginning in November 2026. This release assumes
that their TZ abbreviation will be MST from that time forward (though this
could change). There is also a historical correction for Moldova, which has used
EU DST transition times since 2022.

Updating
--------

All PostgreSQL update releases are cumulative. As with other minor releases,
users are not required to dump and reload their database or use `pg_upgrade`
in order to apply this update release; you may simply stop PostgreSQL and
update its binaries.

Users who have skipped one or more update releases may need to run additional
post-update steps; please see the release notes from earlier versions for
details.

For more details, please see the [release notes](https://www.postgresql.org/docs/release/).

Links
-----

* [Download](https://www.postgresql.org/download/)
* [Release Notes](https://www.postgresql.org/docs/release/)
* [Security](https://www.postgresql.org/support/security/)
* [Versioning Policy](https://www.postgresql.org/support/versioning/)
* [Submit a Bug](https://www.postgresql.org/account/submitbug/)
* [Donate](https://www.postgresql.org/about/donate/)

If you have corrections or suggestions for this release announcement, please send them to the _pgsql-www(at)lists(dot)postgresql(dot)org_ public [mailing list](https://www.postgresql.org/list/).