PostgreSQL Sees New Releases For 52 Security Vulnerabilities, 140+ Bug Fixes

PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC2 all released today due to 52 new security issues being disclosed. PostgreSQL developers, like many in the open-source world, have been hammered by bug reports and security findings fueled by AI/LLMs. PostgreSQL 19 has been running weeks behind schedule due to the AI/LLM burden and now today is a slew of new releases for addressing recent security vulnerabilities reported to them. Of the 52 CVEs fixed in these new PostgreSQL server database releases, several of them carry a CVSS score in the 8.8 range for severity. CVE-2026-6460: Type confusion after ALTER ... SET DATA TYPE executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-6467: Extension script schema mishandling executes arbitrary SQL (CVSS v3.1: 7.2) CVE-2026-14661: dblink and subscriptions can append to arbitrary files (CVSS v3.1: 8.1) CVE-2026-16237: INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition (CVSS v3.1: 5.4) CVE-2026-16240: pg_basebackup can use backup manifest content as a format string (CVSS v3.1: 3.7) CVE-2026-18447: Output parameter type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116303: Foreign key and JSON conversions bypass EXECUTE privilege on cast functions (CVSS v3.1: 3.1) CVE-2026-116304: Parallel RECORD typmod use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116306: Composite-type change during field assignment executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116307: plperl prepared-query use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116308: dict_int reads beyond zero-length tokens (CVSS v3.1: 4.3) CVE-2026-116309: plperl blessed-reference type confusion may execute arbitrary code (CVSS v3.1: 8.8) CVE-2026-116310: COPY error context uses freed field storage (CVSS v3.1: 4.3) CVE-2026-116311: DROP OWNED can remove restrictive row security policies from non-owned tables (CVSS v3.1: 5.4) CVE-2026-116312: MERGE can place the wrong row in a trigger transition table (CVSS v3.1: 5.4) CVE-2026-116313: vacuumdb --missing-stats-only lets a database owner execute code as the vacuumdb user (CVSS v3.1: 7.2) CVE-2026-116314: pg_restore executes arbitrary code due to missing non-plain archive validation (CVSS v3.1: 8.8) CVE-2026-116315: tsvector_delete() heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116316: Security-restricted operations can create types in pg_temp, which later queries of the session find (CVSS v3.1: 8.8) CVE-2026-116317: ts_rank_cd() heap buffer overflow may execute arbitrary code (CVSS v3.1: 8.8) CVE-2026-116318: pg_dump not-null constraint name allows SQL injection (CVSS v3.1: 8.8) CVE-2026-116319: plperl reentrant return_next() use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116320: plperl array and hash conversion use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116321: Unterminated name value discloses server memory (CVSS v3.1: 4.3) CVE-2026-116322: Pre-authentication cancel request can leak a spinlock (CVSS v3.1: 5.3) CVE-2026-116323: pltcl reentrant result conversion use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116325: reindexdb index name quoting allows SQL injection (CVSS v3.1: 8) CVE-2026-116326: plperl tied-object exceptions follow stale sigjmp_buf (CVSS v3.1: 8.8) CVE-2026-116327: security_barrier analysis can expose hidden values through indirect expressions (CVSS v3.1: 4.3) CVE-2026-116328: Generation memory context integer wraparound executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116329: Statistics import type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116330: pg_dump tar restore.sql fails to block psql command injection (CVSS v3.1: 8.8) CVE-2026-116331: Min/max aggregate type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116332: Portal setup use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116333: Parallel B-tree array scan reads beyond array bounds (CVSS v3.1: 6.5) CVE-2026-116335: Commutator or negator result-type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-116336: REINDEX CONCURRENTLY does not block DROP INDEX during index functions (CVSS v3.1: 8.8) CVE-2026-120139: Tuple-size integer wraparound executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120141: Materialized set-returning function type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120142: Dropped-column type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120143: Transition-table cursor use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120144: Type-cache invalidation gap executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120145: Logical replication can write to subscriber system catalogs, executing arbitrary code (CVSS v3.1: 8.8) CVE-2026-120146: REASSIGN OWNED bypasses role SET and CREATEDB checks (CVSS v3.1: 4.3) CVE-2026-120147: dblink reentrant disconnect use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120148: Extended-statistics pseudo-type confusion executes arbitrary code (CVSS v3.1: 8.1) CVE-2026-120149: FDW batch-insert mismatch executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120150: Expanded-record domain-check use-after-free executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120151: plpgsql record-field type confusion executes arbitrary code (CVSS v3.1: 8.8) CVE-2026-120152: pg_show_all_settings() use-after-free discloses memory (CVSS v3.1: 4.3) CVE-2026-120153: Extension-script substitutions allow SQL injection through object names (CVSS v3.1: 7.2) CVE-2026-120154: INSERT ... ON CONFLICT can read rows despite row security policies (CVSS v3.1: 4.3) Thus the big set of new releases. This also marks the final PostgreSQL 15 release with it going end-of-life. There are also some bug fixes in these new releases with more than 140 known bug fixes. The second release candidate carries these fixes plus also some other last minute fixes. PostgreSQL 19.0 stable is finally nearing its stable release. Downloads and more details on the PostgreSQL updates out today via PostgreSQL.org.