PostgreSQL patches 52 security flaws, including several that let attackers run arbitrary code
PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released
The PostgreSQL Global Development Group has released updates for versions 18.7, 17.12, 16.16, 15.20, and 14.25, plus the second release candidate of PostgreSQL 19. The update closes 52 security vulnerabilities and over 140 bugs, with many flaws enabling arbitrary code execution. PostgreSQL 14 reaches end-of-life with this release. Administrators may need to reindex GIN, pg_trgm GiST, and bpchar B-tree indexes, and take a fresh full backup if using incremental backups.
This release fixes 52 security vulnerabilities and over 140 bugs reported over the last several months.
- ianberdin
Looking at all these security patches reminded me of when I was a kid and I thoroughly cleaned my apartment, wiped away every bit of dust in every single crevice, and then a couple of days later it was all back again. And I thought: am I really going to be doing this my whole life?
- firer
All of these seem to be post-auth, except for CVE-2026-116322 (which doesn't grant code execution, "only" a DoS).
About a year ago I found and exploited CVE-2026-2004, which is also a Postgres post-auth RCE, as part of Wiz's zeroday.cloud competition.
I choose that target because it immediately stood out as highly complex with lots of user input. In my opinion, it's a bad idea to define this as a security boundary in the first place. Access to a database can very likely lead to code execution - there's way too much attack surface.
Most serious cloud providers rightly sandbox their DB offerings exactly for this reason. And this year's zeroday.cloud competition no longer has authenticated Postgres as a target, exactly for this reason.
- lfittl
FWIW, I found it easier to look at the release notes (https://www.postgresql.org/docs/release/18.7/) to understand the overall scope of the CVEs - from the announcement the individual CVE pages are linked, but its hard to scan.