2026-08-13 security release announcementHEADmaster

Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Noah Misch <noah@leadboat.com>

1 files changed, 323 insertions, 0 deletions

diff --git a/update_releases/current/20260813securityrelease.md b/update_releases/current/20260813securityrelease.md
new file mode 100644
index 0000000..1579811
--- /dev/null
+++ b/update_releases/current/20260813securityrelease.md
@@ -0,0 +1,323 @@
+The PostgreSQL Global Development Group has released an update to all
+supported versions of PostgreSQL, including 18.6, 17.11, 16.15, 15.19, and 14.24,
+as well as the third beta release of PostgreSQL 19. This release fixes 28
+security vulnerabilities and over 110 bugs reported over the last several
+months.
+
+This release skips from PostgreSQL 18.4 to 18.6. 18.5 was not shipped due to
+a regression.
+
+There are three issues that may require you to take extra steps after updating,
+which are described in detail below. These issues are related to:
+
+* Parallel GIN index builds
+* [`btree_gist`](https://www.postgresql.org/docs/current/btree-gist.html)
+* [`ltree`](https://www.postgresql.org/docs/current/ltree.html)
+
+For the full list of changes, please review the [release
+notes](https://www.postgresql.org/docs/release/).
+
+PostgreSQL 14 EOL Notice
+------------------------
+
+PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
+running PostgreSQL 14 in a production environment, we suggest that you make
+plans to upgrade to a newer, supported version of PostgreSQL. Please see our
+[versioning policy](https://www.postgresql.org/support/versioning/) for more
+information.
+
+Security Issues
+---------------
+
+The following security vulnerabilities are closed across in this update release.
+You can find more details about the vulnerabilities and their affected versions
+in the links below:
+
+* [CVE-2026-6464](https://www.postgresql.org/support/security/CVE-2026-6464/): psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS v3.1: [8.1](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-6469](https://www.postgresql.org/support/security/CVE-2026-6469/): ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS v3.1: [3.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L))
+* [CVE-2026-6470](https://www.postgresql.org/support/security/CVE-2026-6470/): Fails to check type USAGE privilege (CVSS v3.1: [4.3](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L))
+* [CVE-2026-6471](https://www.postgresql.org/support/security/CVE-2026-6471/): Logical decoding can dlopen arbitrary file (CVSS v3.1: [7.2](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14662](https://www.postgresql.org/support/security/CVE-2026-14662/): tsvector and tsquery undersize allocations, via integer wraparound (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14663](https://www.postgresql.org/support/security/CVE-2026-14663/): pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS v3.1: [6.5](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N))
+* [CVE-2026-14664](https://www.postgresql.org/support/security/CVE-2026-14664/): Regexp heap buffer overflow executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14666](https://www.postgresql.org/support/security/CVE-2026-14666/): Row security caching disregards role modifications (CVSS v3.1: [4.2](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N))
+* [CVE-2026-14668](https://www.postgresql.org/support/security/CVE-2026-14668/): ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS v3.1: [8.1](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H))
+* [CVE-2026-14669](https://www.postgresql.org/support/security/CVE-2026-14669/): to\_char heap buffer overflow executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14670](https://www.postgresql.org/support/security/CVE-2026-14670/): plperl tied object heap buffer overflow executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14671](https://www.postgresql.org/support/security/CVE-2026-14671/): refint plan cache type confusion executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14672](https://www.postgresql.org/support/security/CVE-2026-14672/): Observable response discrepancy with non-default scram\_iterations provides user existence oracle (CVSS v3.1: [5.3](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N))
+* [CVE-2026-14673](https://www.postgresql.org/support/security/CVE-2026-14673/): amcheck does not clear untrusted search path (CVSS v3.1: [3.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N))
+* [CVE-2026-14676](https://www.postgresql.org/support/security/CVE-2026-14676/): pg\_stat\_statements heap buffer overflow executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14677](https://www.postgresql.org/support/security/CVE-2026-14677/): 32-bit pltcl and plperl undersize allocations, via integer wraparound (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14678](https://www.postgresql.org/support/security/CVE-2026-14678/): pg\_trgm picksplit reads past end of buffer (CVSS v3.1: [4.3](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N))
+* [CVE-2026-14679](https://www.postgresql.org/support/security/CVE-2026-14679/): Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (CVSS v3.1: [8.2](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H))
+* [CVE-2026-14680](https://www.postgresql.org/support/security/CVE-2026-14680/): Type confusion via "internal" arguments (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-14681](https://www.postgresql.org/support/security/CVE-2026-14681/): Improper enforcement of GSSAPI encryption when coupled with SSL (CVSS v3.1: [4.2](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N))
+* [CVE-2026-15741](https://www.postgresql.org/support/security/CVE-2026-15741/): Expression deparse allows SQL injection via EXTRACT argument (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H))
+* [CVE-2026-15742](https://www.postgresql.org/support/security/CVE-2026-15742/): fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-16238](https://www.postgresql.org/support/security/CVE-2026-16238/): Type confusion in pg\_restore\_attribute\_stats() executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-16239](https://www.postgresql.org/support/security/CVE-2026-16239/): Type confusion in cursor CLOSE + DECLARE executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+* [CVE-2026-16241](https://www.postgresql.org/support/security/CVE-2026-16241/): ECPG integer underflow can crash the client (CVSS v3.1: [3.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L))
+* [CVE-2026-18024](https://www.postgresql.org/support/security/CVE-2026-18024/): ascii() function reads past end of buffer (CVSS v3.1: [4.3](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N))
+* [CVE-2026-18408](https://www.postgresql.org/support/security/CVE-2026-18408/): psql \\unrestrict lets superuser of pg\_dump origin server execute arbitrary code in psql client (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H))
+* [CVE-2026-19385](https://www.postgresql.org/support/security/CVE-2026-19385/): pg\_dump heap buffer overflow executes arbitrary code (CVSS v3.1: [8.8](https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H))
+
+Bug Fixes and Improvements
+--------------------------
+
+This update fixes over 110 bugs that were reported in the last several
+months.
+
+This specific issue only affects PostgreSQL 14, 15, and 16, but we're
+highlighting it in the release announcement due to its severity:
+
+* Fix a self-deadlock that could occur while replaying WAL generated by an older
+minor version. This regression, introduced in the previous set of minor
+releases, could cause a standby server following a primary running an older
+minor version to become stuck.
+
+The remainder of issues listed below affect PostgreSQL 18. Many of these issues
+also affect other supported versions of PostgreSQL.
+
+* Fix parallel [GIN](https://www.postgresql.org/docs/current/gin.html) index
+builds to correctly update the table's `reltuples` value in `pg_class`.
+Previously, a parallel worker could report an uninitialized row count, leaving
+`reltuples` set to a bogus value (including `Infinity` or `NaN`). Such a
+value can cause autovacuum and autoanalyze to not process the table, and this
+situation will not self-correct. If you have any tables with GIN indexes,
+we recommend checking that their `reltuples` values look reasonable after
+updating. See the "Updating" section for how to identify and repair affected
+tables.
+* Several fixes to
+[`btree_gist`](https://www.postgresql.org/docs/current/btree-gist.html),
+including for `NaN` handling for `float4`/`float8` that could give wrong
+answers for columns containing `NaN` and correct sorting of `bit`/`bit varying`
+values during index building. You may need to reindex `btree_gist`
+indexes on `float` or `bit` columns after updating. See the "Updating" section.
+* Fix an integer overflow in
+[`ltree`](https://www.postgresql.org/docs/current/ltree.html) comparisons.
+`ltree` values containing more than about 14,653 labels could compare
+incorrectly, which could present as a corrupt B-tree index. If you use `ltree`,
+you may need to reindex affected indexes after updating. See the "Updating"
+section.
+* Fix [partition
+pruning](https://www.postgresql.org/docs/current/ddl-partitioning.html#DDL-PARTITION-PRUNING)
+for `RANGE`-partitioned tables so the `DEFAULT` partition is no longer skipped in
+cases where it should be scanned. Previously this could cause rows to be missing
+from query results.
+* Several fixes for partitioned tables that have foreign-table
+partitions, including when run-time partition pruning determined that some
+partitions don't need to be scanned, in-flight requests to foreign servers were
+not always handled correctly, leading to failures.
+* Several fixes to
+[`RETURNING`](https://www.postgresql.org/docs/current/dml-returning.html) with
+`OLD` and `NEW`.
+* Improve hash join performance when there are multiple join keys and many
+`NULL` values.
+* Several fixes to the planner that could produce wrong query results, including
+`value IN (array)` tests where the array might be empty, and `COUNT()` window
+functions that use an `EXCLUDE` clause or lack `ORDER BY`.
+* Add missing checks for the hashability of equality comparisons on container
+types ([arrays](https://www.postgresql.org/docs/current/arrays.html),
+[composite types](https://www.postgresql.org/docs/current/rowtypes.html), and
+[ranges](https://www.postgresql.org/docs/current/rangetypes.html)). Without these
+checks, the planner could choose a hash-based plan that then failed at execution
+with a "could not identify a hash function" error.
+* Fix attaching partitions of indexes that are [exclusion
+constraints](https://www.postgresql.org/docs/current/ddl-constraints.html#DDL-CONSTRAINTS-EXCLUSION),
+which also fixes dump/restore of partitioned exclusion constraints.
+* Fix [`REINDEX
+CONCURRENTLY`](https://www.postgresql.org/docs/current/sql-reindex.html) on an
+index backing a deferred uniqueness constraint, which could cause false
+constraint-violation reports.
+* Restore an index-scan optimization that converts a
+[`LIKE`](https://www.postgresql.org/docs/current/functions-matching.html) or
+regular-expression exact-match pattern into an equality index condition when the
+index and expression collations differ.
+* Several fixes to
+[`jsonpath`](https://www.postgresql.org/docs/current/functions-json.html#FUNCTIONS-SQLJSON-PATH),
+including that the `@?` and `@@` operators now correctly raise an error for an
+undefined variable in the path expression. Previously, because these operators
+cannot supply variable values, an undefined variable was treated as a JSON
+`null` rather than an error, which could also lead to unbounded memory
+consumption.
+* Ensure access is blocked to other sessions' temporary tables, which could
+lead to silently incorrect results.
+* Fix `"no empty local buffer available"` errors during temporary table access
+when a large [`effective_io_concurrency`](https://www.postgresql.org/docs/current/runtime-config-resource.html#GUC-EFFECTIVE-IO-CONCURRENCY)
+setting could allow a single read stream to consume all local buffers.
+* Prevent [autovacuum](https://www.postgresql.org/docs/current/routine-vacuuming.html#AUTOVACUUM)
+from processing databases in the wrong order (lowest-priority first instead of
+highest).
+* Restore [`VACUUM`](https://www.postgresql.org/docs/current/sql-vacuum.html)'s
+wraparound failsafe mode to use the full shared buffer pool as intended, which
+had slowed down emergency vacuuming.
+* Fix possible incorrect decoding of index tuples during GiST and SP-GiST
+[index-only
+scans](https://www.postgresql.org/docs/current/indexes-index-only-scans.html),
+which could emit corrupted data.
+* Fix a race condition in conflict detection under
+[`SERIALIZABLE`](https://www.postgresql.org/docs/current/transaction-iso.html#XACT-SERIALIZABLE)
+isolation. A conflict could be missed when examining an initially-empty btree
+index, allowing conflicting transactions to commit and breaking serializability.
+* Fix WAL logging of operations that clear bits in table [visibility
+maps](https://www.postgresql.org/docs/current/storage-vm.html). This could
+lead to producing incorrect incremental backups or potentially leaving torn-page
+writes uncorrected.
+* Fix [logical
+decoding](https://www.postgresql.org/docs/current/logicaldecoding.html) of empty
+prepared transactions. A prepared transaction with no decodable changes could
+send `COMMIT PREPARED` or `ROLLBACK PREPARED` to the output plugin with no
+preceding `PREPARE`, which breaks replication for the built-in subscriber.
+* Several fixes to [`libpq`](https://www.postgresql.org/docs/current/libpq.html),
+including ensuring it drains all pending bytes from the SSL or GSS decryption
+buffer when reading data, avoiding cases where a client waits for data that has
+already arrived.
+* Fix
+[`pg_createsubscriber`](https://www.postgresql.org/docs/current/app-pgcreatesubscriber.html)
+to clean up objects left on a publisher after failure, including a replication
+slot.
+* Fix [`pg_restore`](https://www.postgresql.org/docs/current/app-pgrestore.html)
+with `--statistics` or `--statistics-only` so that, when combined with other
+selective-restore options such as `--schema`, it restores the expected items,
+matching the behavior of `pg_dump`.
+
+This release also updates time zone data files to tzdata release 2026c, in which
+Alberta (America/Edmonton) will be on year-round UTC-06 (effectively, permanent
+DST) beginning in November 2026. This release assumes that their TZ abbreviation
+will be CST from that time forward (though this could change). It also reflects
+that Morocco (Africa/Casablanca) will move to permanent UTC+00, without daylight
+saving transitions, on September 20, 2026.
+
+Updating
+--------
+
+All PostgreSQL update releases are cumulative. As with other minor releases,
+users are not required to dump and reload their database or use `pg_upgrade`
+in order to apply this update release; you may simply stop PostgreSQL and
+update its binaries.
+
+If you have any tables with GIN indexes, we recommend checking their `reltuples`
+values after updating. A prior bug in parallel GIN index builds could have left
+`reltuples` set to a bogus value (including `Infinity` or `NaN`) that prevents
+autovacuum and autoanalyze from ever processing the table. The following query
+lists the tables that have a GIN index, along with their current `reltuples`:
+
+```
+SELECT DISTINCT t.oid::regclass, t.reltuples
+FROM pg_class t
+JOIN pg_index i ON t.oid = i.indrelid
+JOIN pg_class ic ON i.indexrelid = ic.oid
+WHERE t.relhasindex AND ic.relam = 2742;
+```
+
+For any table whose `reltuples` value looks incorrect, run
+[`ANALYZE`](https://www.postgresql.org/docs/current/sql-analyze.html) on it (or
+create another index) to reset the value.
+
+If you use `btree_gist`, you should reindex `btree_gist` indexes on `float4` or
+`float8` columns that might contain `NaN` values, as well as `btree_gist` indexes
+on `bit` or `bit varying` columns, for example:
+
+```
+REINDEX INDEX your_index_name;
+```
+
+If you use `ltree` and have btree indexes over `ltree` values with very many
+labels (more than about 14,653), you should
+[reindex](https://www.postgresql.org/docs/current/sql-reindex.html) those
+indexes, since they may be corrupt, for example:
+
+```
+REINDEX INDEX your_index_name;
+```
+
+Users who have skipped one or more update releases may need to run additional
+post-update steps; please see the release notes from earlier versions for
+details.
+
+For more details, please see the [release notes](https://www.postgresql.org/docs/release/).
+
+A Note on the PostgreSQL 19 Beta
+--------------------------------
+
+This release marks the third beta release of PostgreSQL 19.
+
+In the spirit of the open source PostgreSQL community, we strongly encourage you
+to test the new features of PostgreSQL 19 on your systems to help us eliminate
+bugs and other issues. While we do not advise you to run PostgreSQL 19 Beta 3 in
+production environments, we encourage you to find ways to run your typical
+application workloads against this beta release.
+
+Your testing and feedback helps the community ensure that PostgreSQL 19
+upholds our standards of delivering a stable, reliable release of the
+world's most advanced open source relational database. Please read more about
+our [beta testing process](https://www.postgresql.org/developer/beta/) and how
+you can contribute:
+
+[https://www.postgresql.org/developer/beta/](https://www.postgresql.org/developer/beta/)
+
+Upgrading to PostgreSQL 19 Beta 3
+---------------------------------
+
+To upgrade to PostgreSQL 19 Beta 3 from an earlier version of PostgreSQL,
+you will need to use a strategy similar to upgrading between major versions of
+PostgreSQL (e.g. `pg_upgrade` or `pg_dump` / `pg_restore`). For more
+information, please visit the documentation section on
+[upgrading](https://www.postgresql.org/docs/19/static/upgrading.html).
+
+Changes Since Beta 2
+--------------------
+
+Fixes and changes in PostgreSQL 19 Beta 3 include:
+
+* Revert `GROUP BY ALL`.
+* Several fixes for the new `FOR PORTION OF` temporal table syntax.
+* Several fixes for the new logical replication sequence synchronization
+feature, including a race involving `REFRESH SEQUENCES`.
+* Fix an "unexpected logical decoding status change" error that could occur when
+logical decoding is activated concurrently.
+* Fix issues around ownership changes for subscriptions.
+* Fix wrong query results from `postgres_fdw` when pushing down an array
+comparison such as `field = ANY($1)` that involves an implicit type coercion.
+* Fix a crash during foreign-key checks involving a nullable `UNIQUE` constraint.
+* Fix `pg_plan_advice` parsing of underscores in numeric literals.
+* Fix a missing `FORMAT` clause when deparsing `JSON_ARRAY(query)`.
+
+Please see the [release notes](https://www.postgresql.org/docs/19/release-19.html)
+for a complete list of new and changed features:
+
+[https://www.postgresql.org/docs/19/release-19.html](https://www.postgresql.org/docs/19/release-19.html)
+
+Testing for Bugs & Compatibility
+--------------------------------
+
+The stability of each PostgreSQL release greatly depends on you, the community,
+to test the upcoming version with your workloads and testing tools to find bugs
+and regressions before the general availability of PostgreSQL 19. As this is a
+Beta, minor changes to database behaviors, feature details, and APIs are still
+possible. Your feedback and testing will help determine the final tweaks on the
+new features, so please test in the near future. The quality of user testing
+helps determine when we can make a final release.
+
+A list of [open issues](https://wiki.postgresql.org/wiki/PostgreSQL_19_Open_Items)
+is publicly available in the PostgreSQL wiki.  You can
+[report bugs](https://www.postgresql.org/account/submitbug/) using this form on
+the PostgreSQL website:
+
+[https://www.postgresql.org/account/submitbug/](https://www.postgresql.org/account/submitbug/)
+
+Links
+-----
+
+* [Download](https://www.postgresql.org/download/)
+* [Release Notes](https://www.postgresql.org/docs/release/)
+* [Security](https://www.postgresql.org/support/security/)
+* [Versioning Policy](https://www.postgresql.org/support/versioning/)
+* [Beta Testing Information](https://www.postgresql.org/developer/beta/)
+* [PostgreSQL 19 Beta Release Notes](https://www.postgresql.org/docs/19/release-19.html)
+* [PostgreSQL 19 Open Issues](https://wiki.postgresql.org/wiki/PostgreSQL_19_Open_Items)
+* [Submit a Bug](https://www.postgresql.org/account/submitbug/)
+* [Donate](https://www.postgresql.org/about/donate/)
+
+If you have corrections or suggestions for this release announcement, please send them to the _pgsql-www@lists.postgresql.org_ public [mailing list](https://www.postgresql.org/list/).