PostgreSQL 18.4, 17.10 closing 11 CVEs

# PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 Released! Source: [https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/](https://www.postgresql.org/about/news/postgresql-184-1710-1614-1518-and-1423-released-3297/) Posted on**2026\-05\-14**by PostgreSQL Global Development Group PostgreSQL ProjectSecurity The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23\. This release fixes 11 security vulnerabilities and over 60 bugs reported over the last several months\. For the full list of changes, please review the[release notes](https://www.postgresql.org/docs/release/)\. ## PostgreSQL 14 EOL Notice PostgreSQL 14 will stop receiving fixes on November 12, 2026\. If you are running PostgreSQL 14 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL\. Please see our[versioning policy](https://www.postgresql.org/support/versioning/)for more information\. ## Security Issues ### [CVE\-2026\-6472](https://www.postgresql.org/support/security/CVE-2026-6472/): PostgreSQL`CREATE TYPE`does not check`multirange`schema`CREATE`privilege CVSS v3\.1 Base Score:[5\.4](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Supported, Vulnerable Versions: 14 \- 18\. Missing authorization in PostgreSQL`CREATE TYPE`allows an object creator to hijack other queries that use`search\_path`to find user\-defined types, including extension\-defined types\. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Jelte Fennema\-Nio for reporting this problem\. ### [CVE\-2026\-6473](https://www.postgresql.org/support/security/CVE-2026-6473/): PostgreSQL server undersizes allocations, via integer wraparound CVSS v3\.1 Base Score:[8\.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Supported, Vulnerable Versions: 14 \- 18\. Integer wraparound in multiple PostgreSQL server features allows an application input provider to cause the server to undersize an allocation and write out\-of\-bounds\. This results in a segmentation fault\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www\.aisle\.com, Bruce Dang of Calif\.io, and Sven Klemm for reporting this problem\. ### [CVE\-2026\-6474](https://www.postgresql.org/support/security/CVE-2026-6474/): PostgreSQL`timeofday\(\)`can disclose portions of server memory CVSS v3\.1 Base Score:[4\.3](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Supported, Vulnerable Versions: 14 \- 18\. Externally\-controlled format string in PostgreSQL`timeofday\(\)`function allows an attacker to retrieve portions of server memory, via crafted timezone zones\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Xint Code for reporting this problem\. ### [CVE\-2026\-6475](https://www.postgresql.org/support/security/CVE-2026-6475/): PostgreSQL`pg\_basebackup`and`pg\_rewind`can overwrite unrelated files of origin superuser choice CVSS v3\.1 Base Score:[8\.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Supported, Vulnerable Versions: 14 \- 18\. Symlink following in PostgreSQL`pg\_basebackup`plain format and in`pg\_rewind`allows an origin superuser to overwrite local files, e\.g\.`/var/lib/postgres/\.bashrc`, that hijack the operating system account\. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared\_preload\_libraries\. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu \(pkugenuine\(at\)gmail\(dot\)com\), Guannan Wang \(wgnbuaa\(at\)gmail\(dot\)com\), and Guancheng Li \(lgcpku\(at\)gmail\(dot\)com\) for reporting this problem\. ### [CVE\-2026\-6476](https://www.postgresql.org/support/security/CVE-2026-6476/): PostgreSQL`pg\_createsubscriber`allows SQL injection via subscription name CVSS v3\.1 Base Score:[7\.2](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Supported, Vulnerable Versions: 17 \- 18\. SQL injection in PostgreSQL`pg\_createsubscriber`allows an attacker with`pg\_create\_subscription`rights to execute arbitrary SQL as a superuser\. The attack takes effect when`pg\_createsubscriber`next runs\. Within major versions 17 and 18, minor versions before PostgreSQL 18\.4 and 17\.10 are affected\. Versions before PostgreSQL 17 are unaffected\. The PostgreSQL project thanks Yu Kunpeng for reporting this problem\. ### [CVE\-2026\-6477](https://www.postgresql.org/support/security/CVE-2026-6477/): PostgreSQL`libpq`lo\_\* functions let server superuser overwrite client stack memory CVSS v3\.1 Base Score:[8\.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Supported, Vulnerable Versions: 14 \- 18\. Use of inherently dangerous function`PQfn\(\.\.\., result\_is\_int=0, \.\.\.\)`in PostgreSQL libpq`lo\_export\(\)`,`lo\_read\(\)`,`lo\_lseek64\(\)`, and`lo\_tell64\(\)`functions allows the server superuser to overwrite a client stack buffer with an arbitrarily\-large response\. Like`gets\(\)`,`PQfn\(\.\.\., result\_is\_int=0, \.\.\.\)`stores arbitrary\-length, server\-determined data into a buffer of unspecified size\. Because both the`\\lo\_export`command in`psql`and`pg\_dump`call`lo\_read\(\)`, the server superuser can overwrite pg\_dump or psql stack memory\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem\. ### [CVE\-2026\-6478](https://www.postgresql.org/support/security/CVE-2026-6478/): PostgreSQL discloses MD5\-hashed passwords via covert timing channel CVSS v3\.1 Base Score:[6\.5](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Supported, Vulnerable Versions: 14 \- 18\. Covert timing channel in comparison of MD5\-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate\. This does not affect scram\-sha\-256 passwords, the default in all supported releases\. However, current databases may have MD5\-hashed passwords originating in upgrades from PostgreSQL 13 or earlier\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Joe Conway for reporting this problem\. ### [CVE\-2026\-6479](https://www.postgresql.org/support/security/CVE-2026-6479/): PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion CVSS v3\.1 Base Score:[7\.5](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Supported, Vulnerable Versions: 14 \- 18\. Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF\_UNIX socket to achieve sustained denial of service\. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Calif\.io in collaboration with Claude and Anthropic Research for reporting this problem\. ### [CVE\-2026\-6575](https://www.postgresql.org/support/security/CVE-2026-6575/): PostgreSQL`pg\_restore\_attribute\_stats`accepts values that cause query planning to read past end of stats array CVSS v3\.1 Base Score:[4\.3](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Supported, Vulnerable Versions: 18\. Buffer over\-read in PostgreSQL function`pg\_restore\_attribute\_stats\(\)`accepts array values of unmatched length, which causes query planning to read past end of one array\. This allows a table maintainer to infer memory values past that array end\. Within major version 18, minor versions before PostgreSQL 18\.4 are affected\. Versions before PostgreSQL 18 are unaffected\. The PostgreSQL project thanks Jeroen Gui for reporting this problem\. ### [CVE\-2026\-6637](https://www.postgresql.org/support/security/CVE-2026-6637/): PostgreSQL`refint`allows stack buffer overflow and SQL injection CVSS v3\.1 Base Score:[8\.8](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Supported, Vulnerable Versions: 14 \- 18\. Stack buffer overflow in PostgreSQL module`refint`allows an unprivileged database user to execute arbitrary code as the operating system user running the database\. A distinct attack is possible if the application declares a user\-controlled column as a`refint`cascade primary key and facilitates user\-controlled updates to that column\. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update\. Versions before PostgreSQL 18\.4, 17\.10, 16\.14, 15\.18, and 14\.23 are affected\. The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem\. ### [CVE\-2026\-6638](https://www.postgresql.org/support/security/CVE-2026-6638/): PostgreSQL`REFRESH PUBLICATION`allows SQL injection via table name CVSS v3\.1 Base Score:[3\.7](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Supported, Vulnerable Versions: 16 \- 18\. SQL injection in PostgreSQL logical replication`ALTER SUBSCRIPTION \.\.\. REFRESH PUBLICATION`allows a subscriber table creator to execute arbitrary SQL with the subscription's publication\-side credentials\. The attack takes effect at the next`REFRESH PUBLICATION`\. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18\.4, 17\.10, and 16\.14 are affected\. Versions before PostgreSQL 16 are unaffected\. The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this problem\. ## Bug Fixes and Improvements This update fixes over 60 bugs that were reported in the last several months\. The issues listed below affect PostgreSQL 18\. Some of these issues may also affect other supported versions of PostgreSQL\. - Fix queries that could return incorrect results when using a nondeterministic collation over a unique index\. - Fix loss of deferrability of foreign\-key triggers\. Previously, a foreign key defined as`DEFERRABLE INITIALLY DEFERRED`would behave as`NOT DEFERRABLE`after being set to`NOT ENFORCED`status and then back to`ENFORCED`\. If you have a foreign key with this problem, after installing this update you can fix it by setting it to`NOT ENFORCED`and then back to`ENFORCED`\. - Improve the planner's ability to apply partition pruning to more cases\. - Fix self\-join removal to handle join clauses that are only boolean columns, for example,`ON t1\.boolcol`\. - Several fixes around virtual generated columns, including ensuring`INSERT \.\.\. ON CONFLICT`works when`EXCLUDED`references a virtual generated column\. - Report a serialization failure when`MERGE`encounters a concurrently\-updated tuple in "repeatable read" or "serializable"[isolation modes](https://www.postgresql.org/docs/current/transaction-iso.html)\. - Fix`CREATE TABLE \.\.\. LIKE \.\.\. INCLUDING STATISTICS`for cases where the source table had one or more dropped columns\. - Fix`WITHOUT OVERLAPS`to allow domains\. - Disallow making a composite type be a member of itself via a`multirange`\. - Fix sometimes\-incorrect results when`array\_agg\(anyarray\)`executes in parallel\. - Prevent bloating during restore of an incremental backup\. - Prevent stuck logical replication slot synchronization worker processes from blocking promotion of a standby server\. - Make the`pg\_aios`system view`pid`column show`NULL`instead of`0`when an entry has no owning process\. - Fix cases where`pg\_stat\_replication`shows`NULL`lag even while replication is active\. - Correctly display JOIN alias variables that are used in`GROUP BY`\. - If the startup process fails, properly shut down other child processes before exiting the postmaster\. - Fix race condition that could cause a standby server following WAL from a primary of an older minor version to get into a crash\-and\-restart loop\. - Prevent indefinite wait in shutdown of a walsender process when logical replication is actively publishing data\. - Ensure that free space map changes are persisted during recovery\. This could have performance ramifications on a standby server after promotion\. - Fix assorted bugs in backup decompression and tar\-parsing code used in`pg\_basebackup`and`pg\_verifybackup`\. - Ensure`pg\_dumpall`doesn't skip role grants with dangling grantor OIDs, restoring the behavior before PostgreSQL 16\. Emits a warning about missing grantor if the source server is PostgreSQL 16 or later\. - Fix`pg\_upgrade`to use the correct protocol version when connecting to older source servers\. - Fix output in`pg\_overexplain`when using the`RANGE\_TABLE`option\. - Fix`postgres\_fdw`crash due to premature cleanup of a failed connection\. This release also updates time zone data files to tzdata release 2026b, in which British Columbia \(America/Vancouver\) will be on year\-round UTC\-07 \(effectively, permanent DST\) beginning in November 2026\. This release assumes that their TZ abbreviation will be MST from that time forward \(though this could change\)\. There is also a historical correction for Moldova, which has used EU DST transition times since 2022\. ## Updating All PostgreSQL update releases are cumulative\. As with other minor releases, users are not required to dump and reload their database or use`pg\_upgrade`in order to apply this update release; you may simply stop PostgreSQL and update its binaries\. Users who have skipped one or more update releases may need to run additional post\-update steps; please see the release notes from earlier versions for details\. For more details, please see the[release notes](https://www.postgresql.org/docs/release/)\. ## Links - [Download](https://www.postgresql.org/download/) - [Release Notes](https://www.postgresql.org/docs/release/) - [Security](https://www.postgresql.org/support/security/) - [Versioning Policy](https://www.postgresql.org/support/versioning/) - [Submit a Bug](https://www.postgresql.org/account/submitbug/) - [Donate](https://www.postgresql.org/about/donate/) If you have corrections or suggestions for this release announcement, please send them to the*pgsql\-www@lists\.postgresql\.org*public[mailing list](https://www.postgresql.org/list/)\.