PostgreSQL fixes 52 security flaws as version 14 ends

The PostgreSQL Global Development Group has released updates for every supported version, 18.7, 17.12, 16.16, 15.20, and 14.25, plus the second release candidate of PostgreSQL 19. The release closes 52 security vulnerabilities and more than 140 other bugs reported over the last several months. Several of the flaws can run arbitrary code or write files the database should not touch, so unpatched servers remain exposed.

The project warned that some fixes may require extra steps after the packages are installed, and directed administrators to the release notes rather than treating the update as a simple restart.

CVE-2026-6460 is a type confusion after ALTER ... SET DATA TYPE that can execute arbitrary code. CVE-2026-18447 is a type confusion in output parameters that can also execute arbitrary code. CVE-2026-116304 is a use-after-free when parallel workers handle record type modifiers, again able to execute arbitrary code. CVE-2026-14661 lets dblink and subscriptions append to arbitrary files. CVE-2026-6467 is mishandling of extension script schemas that can run arbitrary SQL. CVE-2026-16237 lets INSERT ... ON CONFLICT read or change rows that an auto-updatable view's WHERE clause was meant to hide. CVE-2026-16240 lets pg_basebackup treat backup manifest content as a format string. CVE-2026-116303 lets foreign-key and JSON conversions bypass the EXECUTE privilege on cast functions. Published CVSS v3.1 scores run from 8.8 for the code-execution bugs to 3.1 for the privilege bypass.

This is the final release of PostgreSQL 14. That branch is now end of life and will no longer receive security or bug fixes. The project advised anyone still running 14 in production to plan an upgrade to a supported version.