PostgreSQL: PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 Released!

August 13, 2026: PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 Released!

Quick Links

About

Governance

Policies

Feature Matrix

Donate

History

Sponsors

Contributing

Financial

Servers

Latest News

Upcoming Events

Past events

Press

Licence

PostgreSQL 18.6, 17.11, 16.15, 15.19, 14.24 and 19 Beta 3 Released!

Posted on 2026-08-13 by PostgreSQL Global Development Group

PostgreSQL Project

Security

The PostgreSQL Global Development Group has released an update to all<br>supported versions of PostgreSQL, including 18.6, 17.11, 16.15, 15.19, and 14.24,<br>as well as the third beta release of PostgreSQL 19. This release fixes 28<br>security vulnerabilities and over 110 bugs reported over the last several<br>months.

This release skips PostgreSQL 18 versions from PostgreSQL 18.4 to 18.6.<br>18.5 was not shipped due to a regression.

There are three issues that may require you to take extra steps after updating,<br>which are described in detail below. These issues are related to:

Parallel GIN index builds

btree_gist

ltree

For the full list of changes, please review the release<br>notes.

PostgreSQL 14 EOL Notice

PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are<br>running PostgreSQL 14 in a production environment, we suggest that you make<br>plans to upgrade to a newer, supported version of PostgreSQL. Please see our<br>versioning policy for more<br>information.

Security Issues

The following security vulnerabilities are closed across in this update release.<br>You can find more details about the vulnerabilities and their affected versions<br>in the links below:

CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS v3.1: 8.1)

CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS v3.1: 3.8)

CVE-2026-6470: Fails to check type USAGE privilege (CVSS v3.1: 4.3)

CVE-2026-6471: Logical decoding can dlopen arbitrary file (CVSS v3.1: 7.2)

CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (CVSS v3.1: 8.8)

CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS v3.1: 6.5)

CVE-2026-14664: Regexp heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-14666: Row security caching disregards role modifications (CVSS v3.1: 4.2)

CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS v3.1: 8.1)

CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-14671: refint plan cache type confusion executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-14672: Observable response discrepancy with non-default scram_iterations provides user existence oracle (CVSS v3.1: 5.3)

CVE-2026-14673: amcheck does not clear untrusted search path (CVSS v3.1: 3.8)

CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (CVSS v3.1: 8.8)

CVE-2026-14678: pg_trgm picksplit reads past end of buffer (CVSS v3.1: 4.3)

CVE-2026-14679: Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (CVSS v3.1: 8.2)

CVE-2026-14680: Type confusion via "internal" arguments (CVSS v3.1: 8.8)

CVE-2026-14681: Improper enforcement of GSSAPI encryption when coupled with SSL (CVSS v3.1: 4.2)

CVE-2026-15741: Expression deparse allows SQL injection via EXTRACT argument (CVSS v3.1: 8.8)

CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (CVSS v3.1: 8.8)

CVE-2026-16238: Type confusion in pg_restore_attribute_stats() executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-16239: Type confusion in cursor CLOSE + DECLARE executes arbitrary code (CVSS v3.1: 8.8)

CVE-2026-16241: ECPG integer underflow can crash the client (CVSS v3.1: 3.8)

CVE-2026-18024: ascii() function reads past end of buffer (CVSS v3.1: 4.3)

CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (CVSS v3.1: 8.8)

CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (CVSS v3.1: 8.8)

Bug Fixes and Improvements

This update fixes over 110 bugs that were reported in the last several<br>months.

This specific issue only affects PostgreSQL 14, 15, and 16, but we're<br>highlighting it in the release announcement due to its severity:

Fix a self-deadlock that could occur while replaying WAL generated by an older<br>minor version. This regression, introduced in the previous set of minor<br>releases, could cause a standby server following a primary running an older<br>minor version to become stuck.

The remainder of issues listed below affect PostgreSQL 18. Many of these issues<br>also affect other supported versions of...