PostgreSQL 14.25 release notes

This release contains a variety of fixes from 14.24. For information new features in major release 14, see Section E.26 .

This is expected to be the last PostgreSQL release in the 14.X series. Users are encouraged to update to a newer release branch soon.

E.1.1. Migration to Version 14.25

A dump/restore is not required for those running 14.X.

However, several different bugs have been discovered that could result in index corruption. Examine the changelog entries below that mention REINDEX , and reindex any indexes you have that might be affected.

Also, if you are upgrading from a version earlier than 14.24, see Section E.2 .

Add defenses against problems caused by altering composite types concurrently with operations on data of those types (Heikki Linnakangas, Andres Freund, Nathan Bossart, Nikhil Sontakke) § § § § § § § § § § § § § § § § § § § § § § § § § § § § Operations such as ALTER TABLE ... ALTER COLUMN TYPE are hazardous because tuples of the older row layout may still exist in the system. While we have long had some checks to defend against that, they were never really complete, and they entirely failed to detect cases where composite types were changed concurrently with queries using them. This voluminous set of patches attempts to improve that. Introduce versioning logic to permit detection of composite datums that don't match the tuple descriptor we wish to interpret them with. For full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes. If necessary, the new composite_type_mismatch server parameter can be used to disable these checks, but doing so carries security risks. Add locking to prevent cases such as ALTER TYPE on a composite type used in a CREATE TABLE that hasn't committed yet. Tighten the rules whether ALTER COLUMN TYPE is allowed when dependencies exist on the composite type. For example, it's no longer allowed when a function's default expression or new-style SQL function body depends on the type. The PostgreSQL Project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Peter Geoghegan, Mehmet Ince, Bryan Green, Sumedh Pathak, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Daniel Bakker, the Anthropic OSS program, Claude and Ada Logics for reporting this problem. (CVE-2026-6460)

Add defenses against problems caused by altering composite types concurrently with operations on data of those types (Heikki Linnakangas, Andres Freund, Nathan Bossart, Nikhil Sontakke) § § § § § § § § § § § § § § § § § § § § § § § § § § § §

Operations such as ALTER TABLE ... ALTER COLUMN TYPE are hazardous because tuples of the older row layout may still exist in the system. While we have long had some checks to defend against that, they were never really complete, and they entirely failed to detect cases where composite types were changed concurrently with queries using them. This voluminous set of patches attempts to improve that.

Introduce versioning logic to permit detection of composite datums that don't match the tuple descriptor we wish to interpret them with. For full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes. If necessary, the new composite_type_mismatch server parameter can be used to disable these checks, but doing so carries security risks.

Add locking to prevent cases such as ALTER TYPE on a composite type used in a CREATE TABLE that hasn't committed yet.

Tighten the rules whether ALTER COLUMN TYPE is allowed when dependencies exist on the composite type. For example, it's no longer allowed when a function's default expression or new-style SQL function body depends on the type.

The PostgreSQL Project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Peter Geoghegan, Mehmet Ince, Bryan Green, Sumedh Pathak, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Daniel Bakker, the Anthropic OSS program, Claude and Ada Logics for reporting this problem. (CVE-2026-6460)

Cope with concurrent rowtype changes in ExecEvalFieldStore[De]Form() (Tomas Vondra, Heikki Linnakangas) § The PostgreSQL Project thanks OpenAI Codex Security, Bronson Yen, Mehmet Ince, Claude and Ada Logics for reporting this problem. (CVE-2026-116306)

Cope with concurrent rowtype changes in ExecEvalFieldStore[De]Form() (Tomas Vondra, Heikki Linnakangas) §

The PostgreSQL Project thanks OpenAI Codex Security, Bronson Yen, Mehmet Ince, Claude and Ada Logics for reporting this problem. (CVE-2026-116306)

Enforce view row visibility in INSERT ... ON CONFLICT (Peter Geoghegan, Zsolt Parragi) § When applied to a view, INSERT ... ON CONFLICT DO UPDATE could update rows that should be hidden by the view's WHERE clause. Although it was documented, this behavior is surely unexpected, and it gives rise to security problems: a user can update rows he should have no privilege to reach. Updating is incorrect, but inserting is impossible too (it would fail due to the unique arbiter index), so throw an error instead when the case arises. INSERT ... ON CONFLICT DO SELECT could show such rows as well, but no longer does. The PostgreSQL Project thanks Qing Xu, Carl Andersen, Zsolt Parragi, the Anthropic OSS program, Shihao Zhong, and Josef Šimánek for reporting this problem. (CVE-2026-16237)

Enforce view row visibility in INSERT ... ON CONFLICT (Peter Geoghegan, Zsolt Parragi) §

When applied to a view, INSERT ... ON CONFLICT DO UPDATE could update rows that should be hidden by the view's WHERE clause. Although it was documented, this behavior is surely unexpected, and it gives rise to security problems: a user can update rows he should have no privilege to reach. Updating is incorrect, but inserting is impossible too (it would fail due to the unique arbiter index), so throw an error instead when the case arises. INSERT ... ON CONFLICT DO SELECT could show such rows as well, but no longer does.

The PostgreSQL Project thanks Qing Xu, Carl Andersen, Zsolt Parragi, the Anthropic OSS program, Shihao Zhong, and Josef Šimánek for reporting this problem. (CVE-2026-16237)

Align REASSIGN OWNED 's caller-privilege checks with ALTER ... OWNER TO 's checks (Zsolt Parragi) § Since v16, giving an object to another role requires the ability to SET ROLE to that role. However, a role granted INHERIT TRUE, SET FALSE could bypass that via REASSIGN OWNED . A role granted INHERIT FALSE, SET TRUE saw the inverse problem: REASSIGN OWNED failed while ALTER OWNER succeeded. Make REASSIGN follow the ALTER OWNER rules. REASSIGN OWNED also bypassed the CREATEDB privilege check in ALTER DATABASE OWNER . In v15 and v14, REASSIGN OWNED 's privilege check is stricter than the membership checks in ALTER OWNER . Leave that alone, but still fix the missing CREATEDB check. The PostgreSQL Project thanks Zsolt Parragi for reporting this problem. (CVE-2026-120146)

Align REASSIGN OWNED 's caller-privilege checks with ALTER ... OWNER TO 's checks (Zsolt Parragi) §

Since v16, giving an object to another role requires the ability to SET ROLE to that role. However, a role granted INHERIT TRUE, SET FALSE could bypass that via REASSIGN OWNED . A role granted INHERIT FALSE, SET TRUE saw the inverse problem: REASSIGN OWNED failed while ALTER OWNER succeeded. Make REASSIGN follow the ALTER OWNER rules.

REASSIGN OWNED also bypassed the CREATEDB privilege check in ALTER DATABASE OWNER .

In v15 and v14, REASSIGN OWNED 's privilege check is stricter than the membership checks in ALTER OWNER . Leave that alone, but still fix the missing CREATEDB check.

The PostgreSQL Project thanks Zsolt Parragi for reporting this problem. (CVE-2026-120146)

Disallow closing a portal that is still being set up (Michael Paquier) § This change forestalls various use-after-free issues. The PostgreSQL Project thanks Tomas Vondra for reporting this problem. (CVE-2026-116332)

Disallow closing a portal that is still being set up (Michael Paquier) §

This change forestalls various use-after-free issues.

The PostgreSQL Project thanks Tomas Vondra for reporting this problem. (CVE-2026-116332)

Forcibly close portals associated with transition tables at the end of the trigger function (Jeff Davis) § This change avoids use-after-free hazards. The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120143)

Forcibly close portals associated with transition tables at the end of the trigger function (Jeff Davis) §

This change avoids use-after-free hazards.

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120143)

Fix race condition leading to use-after-free in shared tupledesc management (Robert Haas) § The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-116304)

Fix race condition leading to use-after-free in shared tupledesc management (Robert Haas) §

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-116304)

Fix use-after-free in expanded-record domain constraint checking (Tom Lane) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120150)

Fix use-after-free in expanded-record domain constraint checking (Tom Lane) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120150)

Fix buffer overrun in tsvector_delete() (Anthropic OSS program) § With crafted input, tsvector_delete() could be induced to write more bytes than it had allocated for its result. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116315)

Fix buffer overrun in tsvector_delete() (Anthropic OSS program) §

With crafted input, tsvector_delete() could be induced to write more bytes than it had allocated for its result.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116315)

Fix buffer overrun in ts_rank_cd() (Anthropic OSS program) § With crafted input, ts_rank_cd() could be induced to write more bytes than it had allocated for its result. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116317)

Fix buffer overrun in ts_rank_cd() (Anthropic OSS program) §

With crafted input, ts_rank_cd() could be induced to write more bytes than it had allocated for its result.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116317)

Prevent construction of invalid name values via element assignment (Tom Lane) § array_set_element() could be abused to make the last byte of a name -type value nonzero. Subsequent uses of the value would then read past the end, resulting in crashes or disclosure of server memory. While at it, disallow construction of invalidly-encoded strings through this mechanism. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116321)

Prevent construction of invalid name values via element assignment (Tom Lane) §

array_set_element() could be abused to make the last byte of a name -type value nonzero. Subsequent uses of the value would then read past the end, resulting in crashes or disclosure of server memory. While at it, disallow construction of invalidly-encoded strings through this mechanism.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116321)

Treat application of a leaky function to a CaseTestExpr or internal Param node as leaky (Tom Lane) § A CaseTestExpr or internal Param represents the value of an expression somewhere else in the query. If that expression contains a Var then there is potential for information leakage. Therefore, reject such cases when deciding whether an expression is leak-proof. The PostgreSQL Project thanks Only see myself for reporting this problem. (CVE-2026-116327)

Treat application of a leaky function to a CaseTestExpr or internal Param node as leaky (Tom Lane) §

A CaseTestExpr or internal Param represents the value of an expression somewhere else in the query. If that expression contains a Var then there is potential for information leakage. Therefore, reject such cases when deciding whether an expression is leak-proof.

The PostgreSQL Project thanks Only see myself for reporting this problem. (CVE-2026-116327)

Don't generate an index-based plan for an aggregate whose input and output types don't match (Tom Lane) § Previously, we'd blindly do this if the aggregate has a SORTOP option attached. The index-based plan will return the aggregate's input column, leading to type violations and potentially to arbitrary code execution if its declared output type is different. In the master branch, disallow such aggregate declarations. In released branches, add a plan-time check to not generate such plans if the types don't match. The PostgreSQL Project thanks Zheng Yu, Claude and Ada Logics for reporting this problem. (CVE-2026-116331)

Don't generate an index-based plan for an aggregate whose input and output types don't match (Tom Lane) §

Previously, we'd blindly do this if the aggregate has a SORTOP option attached. The index-based plan will return the aggregate's input column, leading to type violations and potentially to arbitrary code execution if its declared output type is different. In the master branch, disallow such aggregate declarations. In released branches, add a plan-time check to not generate such plans if the types don't match.

The PostgreSQL Project thanks Zheng Yu, Claude and Ada Logics for reporting this problem. (CVE-2026-116331)

Check that commutator and negator operator pairs return the same data type (Tom Lane) § Previously, substitution of a commutator or negator operator could lead to a type violation. This patch also cleans up some cases where one operator had a commutator/negator link to another, but the second operator didn't link back to the first. The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116335)

Check that commutator and negator operator pairs return the same data type (Tom Lane) §

Previously, substitution of a commutator or negator operator could lead to a type violation. This patch also cleans up some cases where one operator had a commutator/negator link to another, but the second operator didn't link back to the first.

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116335)

Prevent functions in index predicates and expressions from breaking REINDEX CONCURRENTLY by manipulating the indexes (Michael Paquier) § The PostgreSQL Project thanks Florent Saudel for reporting this problem. (CVE-2026-116336)

Prevent functions in index predicates and expressions from breaking REINDEX CONCURRENTLY by manipulating the indexes (Michael Paquier) §

The PostgreSQL Project thanks Florent Saudel for reporting this problem. (CVE-2026-116336)

Prevent corrupting a newly-installed extension by renaming its target schema during CREATE EXTENSION or by installing it into a temporary schema (Noah Misch) § § With some ingenuity, an attacker could substitute objects of his creation for objects in the extension. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6467)

Prevent corrupting a newly-installed extension by renaming its target schema during CREATE EXTENSION or by installing it into a temporary schema (Noah Misch) § §

With some ingenuity, an attacker could substitute objects of his creation for objects in the extension.

The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6467)

Reject more unsafe names in extension script substitutions (Nathan Bossart) § We already rejected schema and owner names containing quotes, backslashes, and dollar signs, but names containing newlines, carriage returns, delimiters, or the substitution tokens themselves can still achieve SQL injection. Reject all those cases too. The PostgreSQL Project thanks the Anthropic OSS program, Sven Klemm, and Aaron Chen for reporting this problem. (CVE-2026-120153)

Reject more unsafe names in extension script substitutions (Nathan Bossart) §

We already rejected schema and owner names containing quotes, backslashes, and dollar signs, but names containing newlines, carriage returns, delimiters, or the substitution tokens themselves can still achieve SQL injection. Reject all those cases too.

The PostgreSQL Project thanks the Anthropic OSS program, Sven Klemm, and Aaron Chen for reporting this problem. (CVE-2026-120153)

Check EXECUTE privilege before calling cast functions within to_json() and other conversion-to- JSON code (Nathan Bossart, Anthropic OSS program) § Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts. The PostgreSQL Project thanks Filip Janus and the Anthropic OSS program for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within to_json() and other conversion-to- JSON code (Nathan Bossart, Anthropic OSS program) §

Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts.

The PostgreSQL Project thanks Filip Janus and the Anthropic OSS program for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within foreign key enforcement checks (Nathan Bossart) § Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within foreign key enforcement checks (Nathan Bossart) §

Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts.

The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-116303)

Prevent DROP OWNED BY from changing row-level security policies on tables that the current user does not own (Zsolt Parragi, Anthropic OSS program) § Previously, an unprivileged role could remove itself from restrictive policies on tables it does not own. Instead issue a warning, as is already done for privileges that the current user cannot revoke. The PostgreSQL Project thanks Zsolt Parragi and the Anthropic OSS program for reporting this problem. (CVE-2026-116311)

Prevent DROP OWNED BY from changing row-level security policies on tables that the current user does not own (Zsolt Parragi, Anthropic OSS program) §

Previously, an unprivileged role could remove itself from restrictive policies on tables it does not own. Instead issue a warning, as is already done for privileges that the current user cannot revoke.

The PostgreSQL Project thanks Zsolt Parragi and the Anthropic OSS program for reporting this problem. (CVE-2026-116311)

Disallow security-restricted operations from creating types in temporary schemas (Anthropic OSS program, Nathan Bossart) § We already disallowed creating temporary tables in this context, but a type also presents a hazard of shadowing permanent objects and thus allowing privilege escalation. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116316)

Disallow security-restricted operations from creating types in temporary schemas (Anthropic OSS program, Nathan Bossart) §

We already disallowed creating temporary tables in this context, but a type also presents a hazard of shadowing permanent objects and thus allowing privilege escalation.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116316)

Avoid out-of-bounds accesses in FDW batch inserts (Nathan Bossart) § The PostgreSQL Project thanks Sumedh Pathak and Sven Klemm for reporting this problem. (CVE-2026-120149)

Avoid out-of-bounds accesses in FDW batch inserts (Nathan Bossart) §

The PostgreSQL Project thanks Sumedh Pathak and Sven Klemm for reporting this problem. (CVE-2026-120149)

Refuse to create extended statistics on expressions of transient types (Masahiko Sawada) § Disallow CREATE STATISTICS on expressions whose types would not be allowed as table column types, most notably anonymous record types. This prevents other sessions from misinterpreting the stored values. The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-120148)

Refuse to create extended statistics on expressions of transient types (Masahiko Sawada) §

Disallow CREATE STATISTICS on expressions whose types would not be allowed as table column types, most notably anonymous record types. This prevents other sessions from misinterpreting the stored values.

The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-120148)

Reject system catalogs as logical replication targets (Masahiko Sawada) § The PostgreSQL Project thanks Qian Zhang for reporting this problem. (CVE-2026-120145)

Reject system catalogs as logical replication targets (Masahiko Sawada) §

The PostgreSQL Project thanks Qian Zhang for reporting this problem. (CVE-2026-120145)

Check ON CONFLICT target row against RLS policies before applying user quals (Peter Geoghegan, Zsolt Parragi) § Previously, leaky qual expressions could see rows that RLS policies should forbid them from seeing. The PostgreSQL Project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, the Anthropic OSS program, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem. (CVE-2026-120154)

Check ON CONFLICT target row against RLS policies before applying user quals (Peter Geoghegan, Zsolt Parragi) §

Previously, leaky qual expressions could see rows that RLS policies should forbid them from seeing.

The PostgreSQL Project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, the Anthropic OSS program, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem. (CVE-2026-120154)

Validate all connection options in replication subscriptions and contrib/dblink (Jacob Champion) § Previously, these checks were applied inconsistently. The PostgreSQL Project thanks Andrey Krasichkov, Bashir Altawil, and Zsolt Parragi for reporting this problem. (CVE-2026-14661)

Validate all connection options in replication subscriptions and contrib/dblink (Jacob Champion) §

Previously, these checks were applied inconsistently.

The PostgreSQL Project thanks Andrey Krasichkov, Bashir Altawil, and Zsolt Parragi for reporting this problem. (CVE-2026-14661)

Disallow declaring SQL functions as returning type "any" (Peter Geoghegan) § This allowed type violations. The PostgreSQL Project thanks Peter Geoghegan, Claude and Ada Logics for reporting this problem. (CVE-2026-18447)

Disallow declaring SQL functions as returning type "any" (Peter Geoghegan) §

This allowed type violations.

The PostgreSQL Project thanks Peter Geoghegan, Claude and Ada Logics for reporting this problem. (CVE-2026-18447)

Harden more memory-size calculations against integer overflow (Álvaro Herrera) § § The PostgreSQL Project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem. (CVE-2026-120139)

Harden more memory-size calculations against integer overflow (Álvaro Herrera) § §

The PostgreSQL Project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem. (CVE-2026-120139)

Fix type confusion in set-returning functions that return RECORD , when materialized in a query's target list (Melanie Plageman, Robert Haas) § The same tuple descriptor was used across multiple calls, which is unsafe since the actual record type could vary. The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120141)

Fix type confusion in set-returning functions that return RECORD , when materialized in a query's target list (Melanie Plageman, Robert Haas) §

The same tuple descriptor was used across multiple calls, which is unsafe since the actual record type could vary.

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120141)

Cope with concurrent rowtype changes in PL/pgSQL record field assignment (Tom Lane) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120151)

Cope with concurrent rowtype changes in PL/pgSQL record field assignment (Tom Lane) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120151)

Support “ tied ” Perl objects in PL/Perl and associated contrib modules (Andrey Rachitskiy) § Up to now, if you passed a tied object to a PL/Perl operation, it would most likely get treated as undef , since we failed to perform Perl get magic on values we're passed. Tied hashes worked partially, in that you could read out their keys, but the values always read as undef . Originally this was intended as a master-only change, since it looks like a feature addition. But afterwards we discovered that assorted security-grade misbehaviors could be triggered by tied objects even without this patch. Rather than trying to secure two sets of behaviors, it seems best to back-patch this change first. (CVE-2026-116326)

Support “ tied ” Perl objects in PL/Perl and associated contrib modules (Andrey Rachitskiy) §

Up to now, if you passed a tied object to a PL/Perl operation, it would most likely get treated as undef , since we failed to perform Perl get magic on values we're passed. Tied hashes worked partially, in that you could read out their keys, but the values always read as undef .

Originally this was intended as a master-only change, since it looks like a feature addition. But afterwards we discovered that assorted security-grade misbehaviors could be triggered by tied objects even without this patch. Rather than trying to secure two sets of behaviors, it seems best to back-patch this change first. (CVE-2026-116326)

Fix PL/Perl to cope with errors thrown from tied objects (Tom Lane, Andrew Dunstan) § § The PostgreSQL Project thanks Ngoc Tran, the Anthropic OSS program, and Dwij Mehta for reporting this problem. (CVE-2026-116326)

Fix PL/Perl to cope with errors thrown from tied objects (Tom Lane, Andrew Dunstan) § §

The PostgreSQL Project thanks Ngoc Tran, the Anthropic OSS program, and Dwij Mehta for reporting this problem. (CVE-2026-116326)

Fix type confusion in PL/Perl's get_perl_array_ref() (Andrew Dunstan) § The PostgreSQL Project thanks Zheng Yu for reporting this problem. (CVE-2026-116309)

Fix type confusion in PL/Perl's get_perl_array_ref() (Andrew Dunstan) §

The PostgreSQL Project thanks Zheng Yu for reporting this problem. (CVE-2026-116309)

Fix use-after-free in scans of Perl arrays and hashes (Tom Lane, Anthropic OSS program) § The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116320)

Fix use-after-free in scans of Perl arrays and hashes (Tom Lane, Anthropic OSS program) §

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116320)

Fix use-after-free in plperl_return_next_internal() (Anthropic OSS program) § The PostgreSQL Project thanks the Anthropic OSS program and Ngoc Tran for reporting this problem. (CVE-2026-116319)

Fix use-after-free in plperl_return_next_internal() (Anthropic OSS program) §

The PostgreSQL Project thanks the Anthropic OSS program and Ngoc Tran for reporting this problem. (CVE-2026-116319)

In PL/Perl, fix use-after-free triggered by releasing a prepared query that is being executed (Masahiko Sawada) § The PostgreSQL Project thanks Zheng Yu and the Anthropic OSS program for reporting this problem. (CVE-2026-116307)

In PL/Perl, fix use-after-free triggered by releasing a prepared query that is being executed (Masahiko Sawada) §

The PostgreSQL Project thanks Zheng Yu and the Anthropic OSS program for reporting this problem. (CVE-2026-116307)

Fix use-after-free hazards in re-entrant use of PL/Tcl (Tom Lane) § The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116323)

Fix use-after-free hazards in re-entrant use of PL/Tcl (Tom Lane) §

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116323)

Reject re-entrant use of contrib/dblink (Masahiko Sawada) § The PostgreSQL Project thanks Jiyong Ahn for reporting this problem. (CVE-2026-120147)

Reject re-entrant use of contrib/dblink (Masahiko Sawada) §

The PostgreSQL Project thanks Jiyong Ahn for reporting this problem. (CVE-2026-120147)

In contrib/dict_int , return NULL for zero-length tokens (Nathan Bossart, Anthropic OSS program) § This behavior is consistent with other text- dictionary types, and it avoids disclosure of server memory as was possible previously. The PostgreSQL Project thanks Nathan Bossart and the Anthropic OSS program for reporting this problem. (CVE-2026-116308)

In contrib/dict_int , return NULL for zero-length tokens (Nathan Bossart, Anthropic OSS program) §

This behavior is consistent with other text- dictionary types, and it avoids disclosure of server memory as was possible previously.

The PostgreSQL Project thanks Nathan Bossart and the Anthropic OSS program for reporting this problem. (CVE-2026-116308)

Make the \[un]restrict commands functional in pg_dump 's tar-format output (Noah Misch) § This provides the intended level of protection to users who make use of the undocumented restore.sql tar member. The PostgreSQL Project thanks Pavel Kopylov for reporting this problem. (CVE-2026-116330)

Make the \[un]restrict commands functional in pg_dump 's tar-format output (Noah Misch) §

This provides the intended level of protection to users who make use of the undocumented restore.sql tar member.

The PostgreSQL Project thanks Pavel Kopylov for reporting this problem. (CVE-2026-116330)

Harden pg_restore against corrupt archive files (Dilip Kumar, Yonghwa Lee, Nathan Bossart) § This patch fixes out-of-bounds accesses and file path traversal hazards. There remain other issues that don't seem to amount to security bugs. The PostgreSQL Project thanks Dilip Kumar, Yonghwa Lee, OpenSec, and Ben Dixon for reporting this problem. (CVE-2026-116314)

Harden pg_restore against corrupt archive files (Dilip Kumar, Yonghwa Lee, Nathan Bossart) §

This patch fixes out-of-bounds accesses and file path traversal hazards. There remain other issues that don't seem to amount to security bugs.

The PostgreSQL Project thanks Dilip Kumar, Yonghwa Lee, OpenSec, and Ben Dixon for reporting this problem. (CVE-2026-116314)

Fix use of externally-controlled format string in pg_basebackup (Peter Eisentraut) § This problem could only be reached if files with unusual names exist in the server's data directory. The PostgreSQL Project thanks Peter Eisentraut for reporting this problem. (CVE-2026-16240)

Fix use of externally-controlled format string in pg_basebackup (Peter Eisentraut) §

This problem could only be reached if files with unusual names exist in the server's data directory.

The PostgreSQL Project thanks Peter Eisentraut for reporting this problem. (CVE-2026-16240)

Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) § Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results. This patch disables de-duplication for new index entries, but does nothing possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update. Note that this problem only applies to columns declared as bpchar , that is, lacking any length constraint. The more common usage of CHAR( n ) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) §

Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results.

This patch disables de-duplication for new index entries, but does nothing possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update.

Note that this problem only applies to columns declared as bpchar , that is, lacking any length constraint. The more common usage of CHAR( n ) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § § When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § §

When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) § The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) §

The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) § REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors “ missing chunk number ” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) §

REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors “ missing chunk number ” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § § These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “ failed to build any N-way joins ” .

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § §

These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “ failed to build any N-way joins ” .

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) § In rare cases, planning could fail with “ failed to assign all NestLoopParams to plan nodes ” , “ plan should not reference subplan's variable ” , or “ variable not found in subplan target list ” errors.

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) §

In rare cases, planning could fail with “ failed to assign all NestLoopParams to plan nodes ” , “ plan should not reference subplan's variable ” , or “ variable not found in subplan target list ” errors.

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § § Depending on the plan shape selected, such cases could produce wrong results, or could fail with “ variable not found in subplan target lists ” .

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § §

Depending on the plan shape selected, such cases could produce wrong results, or could fail with “ variable not found in subplan target lists ” .

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) § This oversight led to errors like “ cannot handle unplanned sub-select ” or “ unrecognized node type ” .

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) §

This oversight led to errors like “ cannot handle unplanned sub-select ” or “ unrecognized node type ” .

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) § This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) §

This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Fix incorrect behavior of MIN() / MAX() index scans when query specifies FETCH ... WITH TIES (Chaitanya Choudhary) § The WITH TIES option was accidentally copied into the sub-SELECT generated to perform the index scan, possibly triggering “ more than one row returned by a subquery used as an expression ” errors.

Fix incorrect behavior of MIN() / MAX() index scans when query specifies FETCH ... WITH TIES (Chaitanya Choudhary) §

The WITH TIES option was accidentally copied into the sub-SELECT generated to perform the index scan, possibly triggering “ more than one row returned by a subquery used as an expression ” errors.

Use the correct collation when unique-ifying a semijoin's righthand side (Andrey Rachitskiy) § This is an issue only if the join's comparison clause uses a non-deterministic collation, since all deterministic collations agree on string equality. But if it does, it was possible to produce incorrect results with too many rows.

Use the correct collation when unique-ifying a semijoin's righthand side (Andrey Rachitskiy) §

This is an issue only if the join's comparison clause uses a non-deterministic collation, since all deterministic collations agree on string equality. But if it does, it was possible to produce incorrect results with too many rows.

Acquire a predicate lock on conflicting rows during INSERT ... ON CONFLICT (Zsolt Parragi, Andrey Borodin) § § Failure to do this resulted in incorrect behavior in serializable mode, allowing concurrent updates that should have failed with a serialization error.

Acquire a predicate lock on conflicting rows during INSERT ... ON CONFLICT (Zsolt Parragi, Andrey Borodin) § §

Failure to do this resulted in incorrect behavior in serializable mode, allowing concurrent updates that should have failed with a serialization error.

Fix incorrect multi-column RANGE partition pruning (David Rowley) § When performing partition pruning with a RANGE partitioned table where pruning quals are only present for a leading prefix of the partition key, it was possible for partition pruning to prune away some partitions that shouldn't be pruned (leading to missing some rows that should be found) and/or include some partitions that were not needed.

Fix incorrect multi-column RANGE partition pruning (David Rowley) §

When performing partition pruning with a RANGE partitioned table where pruning quals are only present for a leading prefix of the partition key, it was possible for partition pruning to prune away some partitions that shouldn't be pruned (leading to missing some rows that should be found) and/or include some partitions that were not needed.

Fix incorrect pruning of DEFAULT partitions in range-partitioned tables that use MINVALUE or MAXVALUE bounds (Ewan Young) § In some cases the code would incorrectly conclude that the DEFAULT partition needn't be scanned, causing failure to find some rows that should match the query.

Fix incorrect pruning of DEFAULT partitions in range-partitioned tables that use MINVALUE or MAXVALUE bounds (Ewan Young) §

In some cases the code would incorrectly conclude that the DEFAULT partition needn't be scanned, causing failure to find some rows that should match the query.

Fix problems with queries applying multiple sort keys to a single column (David Rowley, Ayush Tiwari) § Some queries could crash the backend, while in other cases the additional sort specifications were ignored. Ordinarily such additional sort specifications are redundant anyway, since the first one would fully determine the result ordering. However, this is not necessarily so with non-deterministic collations, or with queries using different ORDER BY operators.

Fix problems with queries applying multiple sort keys to a single column (David Rowley, Ayush Tiwari) §

Some queries could crash the backend, while in other cases the additional sort specifications were ignored. Ordinarily such additional sort specifications are redundant anyway, since the first one would fully determine the result ordering. However, this is not necessarily so with non-deterministic collations, or with queries using different ORDER BY operators.

Avoid possible re-use of stale hash tables when a hashed SubPlan is referenced in multiple places (Rahul Yadav) § §

Avoid possible re-use of stale hash tables when a hashed SubPlan is referenced in multiple places (Rahul Yadav) § §

Ensure that Memoize plan nodes use the correct input collation (Shihao Zhong) § This matters only when using non-deterministic collations.

Ensure that Memoize plan nodes use the correct input collation (Shihao Zhong) §

This matters only when using non-deterministic collations.

Fix wrong results from Memoize plans when a Param is a subexpression of a cache key (Richard Guo) § §

Fix wrong results from Memoize plans when a Param is a subexpression of a cache key (Richard Guo) § §

Fix loss of parallel worker statistics for Memoize plan nodes underneath a Gather (Tatsuya Kawata) § Only the statistics since the last rescan of the Gather were reported by EXPLAIN ANALYZE .

Fix loss of parallel worker statistics for Memoize plan nodes underneath a Gather (Tatsuya Kawata) §

Only the statistics since the last rescan of the Gather were reported by EXPLAIN ANALYZE .

Don't create a shell type if a function definition specifies an unknown return type name with array or type modifier syntax (Heikki Linnakangas) § Such cases are surely errors, since you should create the type before doing anything advanced with it.

Don't create a shell type if a function definition specifies an unknown return type name with array or type modifier syntax (Heikki Linnakangas) §

Such cases are surely errors, since you should create the type before doing anything advanced with it.

Fix snapshot export and import to work properly on a snapshot taken during recovery (Peter Geoghegan, Bertrand Drouvot) § The data layout is different in such a snapshot, but the export/import logic didn't know that, so that the imported snapshot behaved incorrectly. This led not only to wrong answers within the importing transaction, but possibly to persistent data corruption due to it setting hint bits incorrectly. This bug is known to be triggered by parallel pg_dump , when run on a standby server. In that context it could corrupt both the dump output and the standby server's data.

Fix snapshot export and import to work properly on a snapshot taken during recovery (Peter Geoghegan, Bertrand Drouvot) §

The data layout is different in such a snapshot, but the export/import logic didn't know that, so that the imported snapshot behaved incorrectly. This led not only to wrong answers within the importing transaction, but possibly to persistent data corruption due to it setting hint bits incorrectly.

This bug is known to be triggered by parallel pg_dump , when run on a standby server. In that context it could corrupt both the dump output and the standby server's data.

Fix atomicity problem in transaction snapshot import (Chee Wooson) § There was a window in which onlookers might not see the source transaction as still running, possibly allowing wrong decisions by VACUUM for example.

Fix atomicity problem in transaction snapshot import (Chee Wooson) §

There was a window in which onlookers might not see the source transaction as still running, possibly allowing wrong decisions by VACUUM for example.

Fix GIN index searches for plain scalar strings in strict jsonpath queries (Rui Zhao) § A jsonb_ops index scan for a jsonpath such as strict $ == "scalar" failed to find table entries that were simply "scalar" .

Fix GIN index searches for plain scalar strings in strict jsonpath queries (Rui Zhao) §

A jsonb_ops index scan for a jsonpath such as strict $ == "scalar" failed to find table entries that were simply "scalar" .

Fix errors in extraction of GIN index scan conditions from jsonpath queries (Tom Lane) § An AND operator underneath a NOT operator could be misimplemented. Also a method applied to a literal constant, for example "42".double() , was not handled correctly. These mistakes did not cause visible errors, but the GIN index would miss some or all of the rows that should match.

Fix errors in extraction of GIN index scan conditions from jsonpath queries (Tom Lane) §

An AND operator underneath a NOT operator could be misimplemented. Also a method applied to a literal constant, for example "42".double() , was not handled correctly. These mistakes did not cause visible errors, but the GIN index would miss some or all of the rows that should match.

Fix edge-case error in SP-GiST quad-tree <@ searches (John Naylor) § Due to roundoff error, the might sometimes not descend into a quadrant that it needs to , leading to incomplete query results.

Fix edge-case error in SP-GiST quad-tree <@ searches (John Naylor) §

Due to roundoff error, the might sometimes not descend into a quadrant that it needs to , leading to incomplete query results.

Fix edge-case failures in SP-GiST quad-tree indexes (Ayush Tiwari) § Roundoff errors could allow searches and insertions to fail with “ getQuadrant: impossible case ” errors.

Fix edge-case failures in SP-GiST quad-tree indexes (Ayush Tiwari) §

Roundoff errors could allow searches and insertions to fail with “ getQuadrant: impossible case ” errors.

Accept empty tsquery values in binary input (Ayush Tiwari) § An empty tsquery value is allowed elsewhere, but tsqueryrecv() failed.

Accept empty tsquery values in binary input (Ayush Tiwari) §

An empty tsquery value is allowed elsewhere, but tsqueryrecv() failed.

Disallow zero-length lexemes and out-of-range phrase distance values in binary input of tsquery values (Tom Lane) § These cases were already rejected during text input, but tsqueryrecv() omitted making equivalent checks. That allowed accepting values that would fail subsequent dump/reload.

Disallow zero-length lexemes and out-of-range phrase distance values in binary input of tsquery values (Tom Lane) §

These cases were already rejected during text input, but tsqueryrecv() omitted making equivalent checks. That allowed accepting values that would fail subsequent dump/reload.

Consistently enforce maximum lengths in tsvector and tsquery (Tom Lane) § Some places thought the maximum lexeme length was MAXSTRLEN (2047), while others thought it was MAXSTRLEN-1 . Fortunately, the looser bound is correct, so make them all use MAXSTRLEN . Likewise, some places were stricter than others the total data length limit, MAXSTRPOS . These fixes avoid situations where a validly-constructed value would fail dump/reload.

Consistently enforce maximum lengths in tsvector and tsquery (Tom Lane) §

Some places thought the maximum lexeme length was MAXSTRLEN (2047), while others thought it was MAXSTRLEN-1 . Fortunately, the looser bound is correct, so make them all use MAXSTRLEN . Likewise, some places were stricter than others the total data length limit, MAXSTRPOS . These fixes avoid situations where a validly-constructed value would fail dump/reload.

Fix right() with a length argument of INT_MIN (-2147483648) (Ewan Young) § Due to integer overflow, the function returned the whole string when it should return an empty string.

Fix right() with a length argument of INT_MIN (-2147483648) (Ewan Young) §

Due to integer overflow, the function returned the whole string when it should return an empty string.

Fix pg_blocking_pids() to account correctly for relation extension locks (Bertrand Drouvot) §

Fix pg_blocking_pids() to account correctly for relation extension locks (Bertrand Drouvot) §

Fix 32-vs-64-bit confusion in pg_indexam_progress_phasename() (Markos Fountoulakis) § This function accidentally worked on common hardware, but could misbehave on 32-bit or big-endian platforms.

Fix 32-vs-64-bit confusion in pg_indexam_progress_phasename() (Markos Fountoulakis) §

This function accidentally worked on common hardware, but could misbehave on 32-bit or big-endian platforms. ...