PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user
Severity: high · Patch status: patched · Since 2026-11-12 · CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116310, CVE-2026-116311, CVE-2026-116312, CVE-2026-116313, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116318, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116322, CVE-2026-116323, CVE-2026-116325, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116329, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116333, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120142, CVE-2026-120143, CVE-2026-120144, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6467
On 12 November 2026 the PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25, plus 19 RC 2, fixing 52 security vulnerabilities and over 140 bugs. About 30 of the CVEs are memory-safety or type-confusion flaws scored CVSS 8.8 that can run code as the operating-system user running the database; most need a database account that can create objects or run SQL, and no CVE scores 9.0 or above. Other fixes cover SQL injection in pgdump, reindexdb and extension scripts, privilege bypasses in row security, DROP OWNED and REASSIGN OWNED, and a dblink/subscription file-append issue. The only unauthenticated item is a denial-of-service restart (CVE-2026-116322, CVSS 5.3). PostgreSQL 14 is end-of-life with this release. No exploitation is reported. Some fixes need post-update steps (reindexing, new backups for incremental backups), so read the release notes before upgrading.
What to do
- Upgrade all PostgreSQL deployments to 18.7, 17.12, 16.16, 15.20 or 14.25 (or 19 RC 2 for testing); prioritise databases where untrusted users can create objects or run SQL
- Plan migration off PostgreSQL 14, which is now end-of-life
- Review the release notes and apply required post-update steps (reindexing, new full backup before incremental backups)
- Restrict CREATE privileges and untrusted SQL execution, and avoid restoring untrusted dump or archive files, until patched
- Rebuild or restore workflows using patched pg_dump, pg_restore and pg_basebackup clients
Fixed versions
- 18.7
- 17.12
- 16.16
- 15.20
- 14.25
- 19 RC 2
Sources
- PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released, fixes 52 security vulnerabilities (seclists.org)
- PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released (PostgreSQL Global Development Group)
- NVD CVE-2026-6460 (PostgreSQL, type confusion after ALTER ... SET DATA TYPE) (NVD)
All live incidents on Threat Watch