From f6c13839c5e7e901830ca31cc1d437f09c90dda5 Mon Sep 17 00:00:00 2001 From: Yogesh Sharma Date: Wed, 2 Sep 2026 00:42:17 -0400 Subject: [PATCH v1] PG17 following CVEs were not back patched. Remove CVE-2026-16238 and CVE-2026-14676. --- doc/src/sgml/release-17.sgml | 54 ------------------------------------ 1 file changed, 54 deletions(-) diff --git a/doc/src/sgml/release-17.sgml b/doc/src/sgml/release-17.sgml index bb8cf57bb0f..be5a91c4e60 100644 --- a/doc/src/sgml/release-17.sgml +++ b/doc/src/sgml/release-17.sgml @@ -355,35 +355,6 @@ Branch: REL_14_STABLE [42d333a78] 2026-08-10 06:38:36 -0700 - - Fix multirange type handling - in pg_restore_attribute_stats() - (OpenAI Security Research Team) - - - - pg_restore_attribute_stats() treated multirange - types just like their underlying range type. This works correctly - for the bounds histogram, but it was wrong for all the other - statistics kinds. - - - - The PostgreSQL Project thanks - Amy Burnett (OpenAI Codex Security) - for reporting this problem. - (CVE-2026-16238) - - - - - - - Fix buffer overrun - in contrib/pg_stat_statements (Álvaro Herrera) - - - - Query normalization didn't accurately account for the amount of - space the normalized string would require. - - - - The PostgreSQL Project thanks - Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang - for reporting this problem. - (CVE-2026-14676) - - - - -