PostgreSQL Fixes 52 Vulnerabilities, Some Allowing Code Execution, as PostgreSQL 14 Gets Its Final Update

The PostgreSQL Global Development Group, which develops the open source PostgreSQL database, released updates for all supported branches (18.7, 17.12, 16.16, 15.20, and 14.25), dated November 12, 2026, along with PostgreSQL 19 RC 2, the second release candidate of the next major version. The updates fix 52 security vulnerabilities and more than 140 bugs, and some of the vulnerabilities could allow arbitrary code to be executed with the privileges of the operating system user running the database.

52 Vulnerabilities and Over 140 Bugs Fixed at Once

According to the official announcement, the release fixes 52 security vulnerabilities. Many of the vulnerabilities listed in the announcement are described as ones that "executes arbitrary code," and many carry a CVSS v3 base score of 8.8.

The issues span a wide range. They include type confusion, use-after-free, and heap buffer overflow bugs in the core server, as well as problems in procedural languages and extensions such as PL/Perl, PL/Tcl, and dblink, and in bundled tools such as pgdump, pgrestore, reindexdb, and vacuumdb. Some allow rows to be read despite row security policies, and others disclose server memory.

The Representative Flaw, CVE-2026-6460, Lets Users Who Can Create Objects Run Code

A representative example is CVE-2026-6460, with a CVSS v3 base score of 8.8. According to the official description, type confusion, primarily via ALTER ... SET DATA TYPE, allows an object creator to execute arbitrary code as the operating system user running the database. Other DDL attack routes also exist, such as running ALTER TABLE ... ADD COLUMN, rolling it back, and adding the column again.

The project explains that the system had inadequate tracking of typed values and that values were not self-identifying, so stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. Versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected, and an attack requires a database login with low privileges.

This Is the Final Release of PostgreSQL 14

Version 14.25 is the last release of the PostgreSQL 14 series. The official announcement says PostgreSQL 14 will no longer receive security and bug fixes and encourages users to move to a newer version.

PostgreSQL 19 RC 2, released at the same time, targets a general availability release on November 19, 2026. Changes since RC 1 include reverting a change related to JSON_ARRAY() and JSON_OBJECT(), and the project says objects created with that functionality must be dropped or redefined before upgrading.

Users Should Update Soon and Check the Post-Update Steps

A minor version update does not require a dump and reload or pg_upgrade; replacing the binaries is enough. However, the official announcement lists post-update steps that apply in certain cases. These include reindexing GIN indexes, pgtrgm GiST indexes that use `gisttrgm_ops, and B-tree indexes onbpcharcolumns without a length; taking a new full backup if you use incremental backups; and checking and repairingNOT NULL NO INHERIT` constraints on partitioned tables.

The release also fixes a problem in which the fix for an earlier vulnerability, CVE-2026-6464, caused psql to reject multiple COPY ... FROM STDIN commands in a single command string.

CVE-2026-6460 requires an attacker to be a user who can log in, but the impact is greater in environments where multiple users or applications share the same database. Administrators running their own servers should consider updating to the latest release of their branch soon. Users of managed cloud database services should check their provider's guidance.

Our Take

Fifty-two vulnerabilities is an unusually large number for a regular PostgreSQL release. Because many of them can lead to arbitrary code execution and they extend to procedural languages and bundled tools, environments that grant privileges to outside users, or workflows that restore dumps received from others, should update with particular priority. For organizations still running the 14 series, this is the last fix they will receive, so migration plans need to move faster.

Summary

PostgreSQL released 18.7, 17.12, 16.16, 15.20, and 14.25, dated November 12, fixing 52 security vulnerabilities and more than 140 bugs. The representative flaw, CVE-2026-6460, could let a user who can create objects execute arbitrary code on the server. Because updates for the 14 series end with this release, users should update to the latest version and check the post-update steps that apply to them.