PostgreSQL Security Updates Fix 52 Vulnerabilities Across Supported Versions

The PostgreSQL Global Development Group released minor updates 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, 2026, along with PostgreSQL 19 RC 2. The releases close 52 security vulnerabilities and more than 140 bugs across all supported versions.

PostgreSQL Security Fixes Target High-Severity Issues

Thirty-two of the CVEs received CVSS v3.1 scores of 8.8, the highest in the batch, while the lowest score was 3.1. Many of the flaws involve memory errors or type confusion that could allow arbitrary code execution by the operating-system user running the database process. Exploitation typically requires authentication or the ability to create objects.

One example is CVE-2026-6460, which carries a CVSS score of 8.8. The issue stems from type confusion after an ALTER ... SET DATA TYPE command or related DDL operations such as ADD COLUMN followed by ROLLBACK. An object creator can leverage the flaw to execute arbitrary code. The vulnerability affected all listed branches prior to the updates. Additional problems include extension script mishandling tracked as CVE-2026-6467, improper file appends via dblink or subscriptions under CVE-2026-14661, and several issues in PL/Perl, PL/Tcl, logical replication, pg_dump, pg_restore and row-security checks.

No active exploitation or public proof-of-concept code had been reported at the time of release. The fixes represent the largest single security batch issued for PostgreSQL to date.

Version 14 Reaches End of Life

PostgreSQL 14.25 marks the final release for that branch. Version 14 is now end-of-life, and no further security or bug fixes will be provided. Users running any 14.x release must upgrade to a supported branch to maintain access to patches.

PostgreSQL 19 general availability remains scheduled for November 19, 2026. The 19 RC 2 build included in the November 12 releases allows testing ahead of that date. Organizations planning upgrades should verify compatibility with extensions and client tools before moving to newer major versions.

Post-Update Steps for Administrators

Release notes list several immediate actions. C extensions must be recompiled because the fix for CVE-2026-6460 introduced ABI changes. Administrators should also reindex GIN, pg_trgm GiST or bpchar B-tree indexes if errors surface after the upgrade. A new full backup is recommended before resuming any incremental backup schedule.

Client tools such as pg_dump and pg_restore require updates to match the server versions. Database operators are advised to review the full release notes on the PostgreSQL website for version-specific instructions before applying the patches in production environments.