PostgreSQL 18.7 release notes

This release contains a variety of fixes from 18.6. For information new features in major release 18, see Section E.7 .

E.1.1. Migration to Version 18.7 #

A dump/restore is not required for those running 18.X.

However, several different bugs have been discovered that could result in index corruption. Examine the changelog entries below that mention REINDEX , and reindex any indexes you have that might be affected.

Also, existing incremental backup files should not be trusted, thanks to the discovery of several ways that they could become corrupt. It's recommended that users of incremental backups take a new full backup after updating and use it as the basis for subsequent incremental backups.

Also, if you are upgrading from a version earlier than 18.6, see Section E.2 .

Add defenses against problems caused by altering composite types concurrently with operations on data of those types (Heikki Linnakangas, Andres Freund, Nathan Bossart, Nikhil Sontakke) § § § § § § § § § § § § § § § § § § § § § § § § § § § § Operations such as ALTER TABLE ... ALTER COLUMN TYPE are hazardous because tuples of the older row layout may still exist in the system. While we have long had some checks to defend against that, they were never really complete, and they entirely failed to detect cases where composite types were changed concurrently with queries using them. This voluminous set of patches attempts to improve that. Introduce versioning logic to permit detection of composite datums that don't match the tuple descriptor we wish to interpret them with. For full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes. If necessary, the new composite_type_mismatch server parameter can be used to disable these checks, but doing so carries security risks. Add locking to prevent cases such as ALTER TYPE on a composite type used in a CREATE TABLE that hasn't committed yet. Tighten the rules whether ALTER COLUMN TYPE is allowed when dependencies exist on the composite type. For example, it's no longer allowed when a function's default expression or new-style SQL function body depends on the type. The PostgreSQL Project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Peter Geoghegan, Mehmet Ince, Bryan Green, Sumedh Pathak, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Daniel Bakker, the Anthropic OSS program, Claude and Ada Logics for reporting this problem. (CVE-2026-6460)

Add defenses against problems caused by altering composite types concurrently with operations on data of those types (Heikki Linnakangas, Andres Freund, Nathan Bossart, Nikhil Sontakke) § § § § § § § § § § § § § § § § § § § § § § § § § § § §

Operations such as ALTER TABLE ... ALTER COLUMN TYPE are hazardous because tuples of the older row layout may still exist in the system. While we have long had some checks to defend against that, they were never really complete, and they entirely failed to detect cases where composite types were changed concurrently with queries using them. This voluminous set of patches attempts to improve that.

Introduce versioning logic to permit detection of composite datums that don't match the tuple descriptor we wish to interpret them with. For full protection, this change requires rebuilding C-language extensions, and there are some extensions that will require source-code changes. If necessary, the new composite_type_mismatch server parameter can be used to disable these checks, but doing so carries security risks.

Add locking to prevent cases such as ALTER TYPE on a composite type used in a CREATE TABLE that hasn't committed yet.

Tighten the rules whether ALTER COLUMN TYPE is allowed when dependencies exist on the composite type. For example, it's no longer allowed when a function's default expression or new-style SQL function body depends on the type.

The PostgreSQL Project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Peter Geoghegan, Mehmet Ince, Bryan Green, Sumedh Pathak, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Daniel Bakker, the Anthropic OSS program, Claude and Ada Logics for reporting this problem. (CVE-2026-6460)

Cope with concurrent rowtype changes in ExecEvalFieldStore[De]Form() (Tomas Vondra, Heikki Linnakangas) § The PostgreSQL Project thanks OpenAI Codex Security, Bronson Yen, Mehmet Ince, Claude and Ada Logics for reporting this problem. (CVE-2026-116306)

Cope with concurrent rowtype changes in ExecEvalFieldStore[De]Form() (Tomas Vondra, Heikki Linnakangas) §

The PostgreSQL Project thanks OpenAI Codex Security, Bronson Yen, Mehmet Ince, Claude and Ada Logics for reporting this problem. (CVE-2026-116306)

Guard against malicious alteration of a table while a statistics import function is running on it (Masahiko Sawada) § Previously it was possible to store statistics that no longer match the table, leading to crashes or other problems later. The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-116329)

Guard against malicious alteration of a table while a statistics import function is running on it (Masahiko Sawada) §

Previously it was possible to store statistics that no longer match the table, leading to crashes or other problems later.

The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-116329)

Enforce view row visibility in INSERT ... ON CONFLICT (Peter Geoghegan, Zsolt Parragi) § When applied to a view, INSERT ... ON CONFLICT DO UPDATE could update rows that should be hidden by the view's WHERE clause. Although it was documented, this behavior is surely unexpected, and it gives rise to security problems: a user can update rows he should have no privilege to reach. Updating is incorrect, but inserting is impossible too (it would fail due to the unique arbiter index), so throw an error instead when the case arises. INSERT ... ON CONFLICT DO SELECT could show such rows as well, but no longer does. The PostgreSQL Project thanks Qing Xu, Carl Andersen, Zsolt Parragi, the Anthropic OSS program, Shihao Zhong, and Josef Šimánek for reporting this problem. (CVE-2026-16237)

Enforce view row visibility in INSERT ... ON CONFLICT (Peter Geoghegan, Zsolt Parragi) §

When applied to a view, INSERT ... ON CONFLICT DO UPDATE could update rows that should be hidden by the view's WHERE clause. Although it was documented, this behavior is surely unexpected, and it gives rise to security problems: a user can update rows he should have no privilege to reach. Updating is incorrect, but inserting is impossible too (it would fail due to the unique arbiter index), so throw an error instead when the case arises. INSERT ... ON CONFLICT DO SELECT could show such rows as well, but no longer does.

The PostgreSQL Project thanks Qing Xu, Carl Andersen, Zsolt Parragi, the Anthropic OSS program, Shihao Zhong, and Josef Šimánek for reporting this problem. (CVE-2026-16237)

Align REASSIGN OWNED 's caller-privilege checks with ALTER ... OWNER TO 's checks (Zsolt Parragi) § Since v16, giving an object to another role requires the ability to SET ROLE to that role. However, a role granted INHERIT TRUE, SET FALSE could bypass that via REASSIGN OWNED . A role granted INHERIT FALSE, SET TRUE saw the inverse problem: REASSIGN OWNED failed while ALTER OWNER succeeded. Make REASSIGN follow the ALTER OWNER rules. REASSIGN OWNED also bypassed the CREATEDB privilege check in ALTER DATABASE OWNER . In v15 and v14, REASSIGN OWNED 's privilege check is stricter than the membership checks in ALTER OWNER . Leave that alone, but still fix the missing CREATEDB check. The PostgreSQL Project thanks Zsolt Parragi for reporting this problem. (CVE-2026-120146)

Align REASSIGN OWNED 's caller-privilege checks with ALTER ... OWNER TO 's checks (Zsolt Parragi) §

Since v16, giving an object to another role requires the ability to SET ROLE to that role. However, a role granted INHERIT TRUE, SET FALSE could bypass that via REASSIGN OWNED . A role granted INHERIT FALSE, SET TRUE saw the inverse problem: REASSIGN OWNED failed while ALTER OWNER succeeded. Make REASSIGN follow the ALTER OWNER rules.

REASSIGN OWNED also bypassed the CREATEDB privilege check in ALTER DATABASE OWNER .

In v15 and v14, REASSIGN OWNED 's privilege check is stricter than the membership checks in ALTER OWNER . Leave that alone, but still fix the missing CREATEDB check.

The PostgreSQL Project thanks Zsolt Parragi for reporting this problem. (CVE-2026-120146)

Fix use-after-free in COPY FROM ON_ERROR reporting (Masahiko Sawada) § An error report raised in COPY FROM could disclose server memory. The PostgreSQL Project thanks Jiyong Ahn, Claude and Ada Logics for reporting this problem. (CVE-2026-116310)

Fix use-after-free in COPY FROM ON_ERROR reporting (Masahiko Sawada) §

An error report raised in COPY FROM could disclose server memory.

The PostgreSQL Project thanks Jiyong Ahn, Claude and Ada Logics for reporting this problem. (CVE-2026-116310)

Disallow closing a portal that is still being set up (Michael Paquier) § This change forestalls various use-after-free issues. The PostgreSQL Project thanks Tomas Vondra for reporting this problem. (CVE-2026-116332)

Disallow closing a portal that is still being set up (Michael Paquier) §

This change forestalls various use-after-free issues.

The PostgreSQL Project thanks Tomas Vondra for reporting this problem. (CVE-2026-116332)

Forcibly close portals associated with transition tables at the end of the trigger function (Jeff Davis) § This change avoids use-after-free hazards. The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120143)

Forcibly close portals associated with transition tables at the end of the trigger function (Jeff Davis) §

This change avoids use-after-free hazards.

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120143)

Fix race condition leading to use-after-free in shared tupledesc management (Robert Haas) § The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-116304)

Fix race condition leading to use-after-free in shared tupledesc management (Robert Haas) §

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-116304)

Fix use-after-free in pg_show_all_settings() (Masahiko Sawada) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120152)

Fix use-after-free in pg_show_all_settings() (Masahiko Sawada) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120152)

Fix use-after-free in expanded-record domain constraint checking (Tom Lane) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120150)

Fix use-after-free in expanded-record domain constraint checking (Tom Lane) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120150)

Prevent memory corruption after a large allocation in a “ generation ” memory context is freed (Heikki Linnakangas) § The PostgreSQL Project thanks Jayden Sarveshkumar for reporting this problem. (CVE-2026-116328)

Prevent memory corruption after a large allocation in a “ generation ” memory context is freed (Heikki Linnakangas) §

The PostgreSQL Project thanks Jayden Sarveshkumar for reporting this problem. (CVE-2026-116328)

Fix buffer overrun in tsvector_delete() (Anthropic OSS program) § With crafted input, tsvector_delete() could be induced to write more bytes than it had allocated for its result. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116315)

Fix buffer overrun in tsvector_delete() (Anthropic OSS program) §

With crafted input, tsvector_delete() could be induced to write more bytes than it had allocated for its result.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116315)

Fix buffer overrun in ts_rank_cd() (Anthropic OSS program) § With crafted input, ts_rank_cd() could be induced to write more bytes than it had allocated for its result. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116317)

Fix buffer overrun in ts_rank_cd() (Anthropic OSS program) §

With crafted input, ts_rank_cd() could be induced to write more bytes than it had allocated for its result.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116317)

Prevent construction of invalid name values via element assignment (Tom Lane) § array_set_element() could be abused to make the last byte of a name -type value nonzero. Subsequent uses of the value would then read past the end, resulting in crashes or disclosure of server memory. While at it, disallow construction of invalidly-encoded strings through this mechanism. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116321)

Prevent construction of invalid name values via element assignment (Tom Lane) §

array_set_element() could be abused to make the last byte of a name -type value nonzero. Subsequent uses of the value would then read past the end, resulting in crashes or disclosure of server memory. While at it, disallow construction of invalidly-encoded strings through this mechanism.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116321)

Treat application of a leaky function to a CaseTestExpr or internal Param node as leaky (Tom Lane) § A CaseTestExpr or internal Param represents the value of an expression somewhere else in the query. If that expression contains a Var then there is potential for information leakage. Therefore, reject such cases when deciding whether an expression is leak-proof. The PostgreSQL Project thanks Only see myself for reporting this problem. (CVE-2026-116327)

Treat application of a leaky function to a CaseTestExpr or internal Param node as leaky (Tom Lane) §

A CaseTestExpr or internal Param represents the value of an expression somewhere else in the query. If that expression contains a Var then there is potential for information leakage. Therefore, reject such cases when deciding whether an expression is leak-proof.

The PostgreSQL Project thanks Only see myself for reporting this problem. (CVE-2026-116327)

Don't generate an index-based plan for an aggregate whose input and output types don't match (Tom Lane) § Previously, we'd blindly do this if the aggregate has a SORTOP option attached. The index-based plan will return the aggregate's input column, leading to type violations and potentially to arbitrary code execution if its declared output type is different. In the master branch, disallow such aggregate declarations. In released branches, add a plan-time check to not generate such plans if the types don't match. The PostgreSQL Project thanks Zheng Yu, Claude and Ada Logics for reporting this problem. (CVE-2026-116331)

Don't generate an index-based plan for an aggregate whose input and output types don't match (Tom Lane) §

Previously, we'd blindly do this if the aggregate has a SORTOP option attached. The index-based plan will return the aggregate's input column, leading to type violations and potentially to arbitrary code execution if its declared output type is different. In the master branch, disallow such aggregate declarations. In released branches, add a plan-time check to not generate such plans if the types don't match.

The PostgreSQL Project thanks Zheng Yu, Claude and Ada Logics for reporting this problem. (CVE-2026-116331)

Delay processing of cancel request packets until it's safe to handle them (Michael Paquier) § With luck and good timing, an attacker could induce the process receiving a cancel request packet to exit while holding a spinlock, thereby causing a database crash and restart. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116322)

Delay processing of cancel request packets until it's safe to handle them (Michael Paquier) §

With luck and good timing, an attacker could induce the process receiving a cancel request packet to exit while holding a spinlock, thereby causing a database crash and restart.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116322)

Avoid inserting the wrong tuple into a trigger transition table in a MERGE that does an INSERT followed by an UPDATE (Heikki Linnakangas, Jacek Bylina, Jacob Robertson, Nigel Gott) § The PostgreSQL Project thanks Jacek Bylina, Timothy Ball, Claude and Ada Logics for reporting this problem. (CVE-2026-116312)

Avoid inserting the wrong tuple into a trigger transition table in a MERGE that does an INSERT followed by an UPDATE (Heikki Linnakangas, Jacek Bylina, Jacob Robertson, Nigel Gott) §

The PostgreSQL Project thanks Jacek Bylina, Timothy Ball, Claude and Ada Logics for reporting this problem. (CVE-2026-116312)

Check that commutator and negator operator pairs return the same data type (Tom Lane) § Previously, substitution of a commutator or negator operator could lead to a type violation. This patch also cleans up some cases where one operator had a commutator/negator link to another, but the second operator didn't link back to the first. The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116335)

Check that commutator and negator operator pairs return the same data type (Tom Lane) §

Previously, substitution of a commutator or negator operator could lead to a type violation. This patch also cleans up some cases where one operator had a commutator/negator link to another, but the second operator didn't link back to the first.

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116335)

Prevent functions in index predicates and expressions from breaking REINDEX CONCURRENTLY by manipulating the indexes (Michael Paquier) § The PostgreSQL Project thanks Florent Saudel for reporting this problem. (CVE-2026-116336)

Prevent functions in index predicates and expressions from breaking REINDEX CONCURRENTLY by manipulating the indexes (Michael Paquier) §

The PostgreSQL Project thanks Florent Saudel for reporting this problem. (CVE-2026-116336)

Prevent corrupting a newly-installed extension by renaming its target schema during CREATE EXTENSION or by installing it into a temporary schema (Noah Misch) § § With some ingenuity, an attacker could substitute objects of his creation for objects in the extension. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6467)

Prevent corrupting a newly-installed extension by renaming its target schema during CREATE EXTENSION or by installing it into a temporary schema (Noah Misch) § §

With some ingenuity, an attacker could substitute objects of his creation for objects in the extension.

The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6467)

Reject more unsafe names in extension script substitutions (Nathan Bossart) § We already rejected schema and owner names containing quotes, backslashes, and dollar signs, but names containing newlines, carriage returns, delimiters, or the substitution tokens themselves can still achieve SQL injection. Reject all those cases too. The PostgreSQL Project thanks the Anthropic OSS program, Sven Klemm, and Aaron Chen for reporting this problem. (CVE-2026-120153)

Reject more unsafe names in extension script substitutions (Nathan Bossart) §

We already rejected schema and owner names containing quotes, backslashes, and dollar signs, but names containing newlines, carriage returns, delimiters, or the substitution tokens themselves can still achieve SQL injection. Reject all those cases too.

The PostgreSQL Project thanks the Anthropic OSS program, Sven Klemm, and Aaron Chen for reporting this problem. (CVE-2026-120153)

Check EXECUTE privilege before calling cast functions within to_json() and other conversion-to- JSON code (Nathan Bossart, Anthropic OSS program) § Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts. The PostgreSQL Project thanks Filip Janus and the Anthropic OSS program for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within to_json() and other conversion-to- JSON code (Nathan Bossart, Anthropic OSS program) §

Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts.

The PostgreSQL Project thanks Filip Janus and the Anthropic OSS program for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within foreign key enforcement checks (Nathan Bossart) § Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-116303)

Check EXECUTE privilege before calling cast functions within foreign key enforcement checks (Nathan Bossart) §

Typically such functions would have public EXECUTE privilege anyway, but this puts the behavior on par with normal execution of casts.

The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-116303)

Prevent DROP OWNED BY from changing row-level security policies on tables that the current user does not own (Zsolt Parragi, Anthropic OSS program) § Previously, an unprivileged role could remove itself from restrictive policies on tables it does not own. Instead issue a warning, as is already done for privileges that the current user cannot revoke. The PostgreSQL Project thanks Zsolt Parragi and the Anthropic OSS program for reporting this problem. (CVE-2026-116311)

Prevent DROP OWNED BY from changing row-level security policies on tables that the current user does not own (Zsolt Parragi, Anthropic OSS program) §

Previously, an unprivileged role could remove itself from restrictive policies on tables it does not own. Instead issue a warning, as is already done for privileges that the current user cannot revoke.

The PostgreSQL Project thanks Zsolt Parragi and the Anthropic OSS program for reporting this problem. (CVE-2026-116311)

Disallow security-restricted operations from creating types in temporary schemas (Anthropic OSS program, Nathan Bossart) § We already disallowed creating temporary tables in this context, but a type also presents a hazard of shadowing permanent objects and thus allowing privilege escalation. The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116316)

Disallow security-restricted operations from creating types in temporary schemas (Anthropic OSS program, Nathan Bossart) §

We already disallowed creating temporary tables in this context, but a type also presents a hazard of shadowing permanent objects and thus allowing privilege escalation.

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116316)

Avoid out-of-bounds accesses in FDW batch inserts (Nathan Bossart) § The PostgreSQL Project thanks Sumedh Pathak and Sven Klemm for reporting this problem. (CVE-2026-120149)

Avoid out-of-bounds accesses in FDW batch inserts (Nathan Bossart) §

The PostgreSQL Project thanks Sumedh Pathak and Sven Klemm for reporting this problem. (CVE-2026-120149)

Avoid out-of-bounds reads in parallel btree scans with array keys (Nathan Bossart) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116333)

Avoid out-of-bounds reads in parallel btree scans with array keys (Nathan Bossart) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-116333)

Replace the type cache's in_progress_list mechanism with something simpler and safer (Robert Haas) § The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120144)

Replace the type cache's in_progress_list mechanism with something simpler and safer (Robert Haas) §

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120144)

Refuse to create extended statistics on expressions of transient types (Masahiko Sawada) § Disallow CREATE STATISTICS on expressions whose types would not be allowed as table column types, most notably anonymous record types. This prevents other sessions from misinterpreting the stored values. The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-120148)

Refuse to create extended statistics on expressions of transient types (Masahiko Sawada) §

Disallow CREATE STATISTICS on expressions whose types would not be allowed as table column types, most notably anonymous record types. This prevents other sessions from misinterpreting the stored values.

The PostgreSQL Project thanks Mehmet Ince for reporting this problem. (CVE-2026-120148)

Reject system catalogs as logical replication targets (Masahiko Sawada) § The PostgreSQL Project thanks Qian Zhang for reporting this problem. (CVE-2026-120145)

Reject system catalogs as logical replication targets (Masahiko Sawada) §

The PostgreSQL Project thanks Qian Zhang for reporting this problem. (CVE-2026-120145)

Check ON CONFLICT target row against RLS policies before applying user quals (Peter Geoghegan, Zsolt Parragi) § Previously, leaky qual expressions could see rows that RLS policies should forbid them from seeing. The PostgreSQL Project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, the Anthropic OSS program, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem. (CVE-2026-120154)

Check ON CONFLICT target row against RLS policies before applying user quals (Peter Geoghegan, Zsolt Parragi) §

Previously, leaky qual expressions could see rows that RLS policies should forbid them from seeing.

The PostgreSQL Project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, the Anthropic OSS program, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem. (CVE-2026-120154)

Validate all connection options in replication subscriptions and contrib/dblink (Jacob Champion) § Previously, these checks were applied inconsistently. The PostgreSQL Project thanks Andrey Krasichkov, Bashir Altawil, and Zsolt Parragi for reporting this problem. (CVE-2026-14661)

Validate all connection options in replication subscriptions and contrib/dblink (Jacob Champion) §

Previously, these checks were applied inconsistently.

The PostgreSQL Project thanks Andrey Krasichkov, Bashir Altawil, and Zsolt Parragi for reporting this problem. (CVE-2026-14661)

Handle dropped columns safely while comparing row types (Peter Geoghegan) § Previously, two row types that had dropped columns at the same position could be considered equal even if those columns were of different physical widths. That leads to problems when trying to deconstruct tuples of those types. The PostgreSQL Project thanks Peter Geoghegan and Mehmet Ince for reporting this problem. (CVE-2026-120142)

Handle dropped columns safely while comparing row types (Peter Geoghegan) §

Previously, two row types that had dropped columns at the same position could be considered equal even if those columns were of different physical widths. That leads to problems when trying to deconstruct tuples of those types.

The PostgreSQL Project thanks Peter Geoghegan and Mehmet Ince for reporting this problem. (CVE-2026-120142)

Disallow declaring SQL functions as returning type "any" (Peter Geoghegan) § This allowed type violations. The PostgreSQL Project thanks Peter Geoghegan, Claude and Ada Logics for reporting this problem. (CVE-2026-18447)

Disallow declaring SQL functions as returning type "any" (Peter Geoghegan) §

This allowed type violations.

The PostgreSQL Project thanks Peter Geoghegan, Claude and Ada Logics for reporting this problem. (CVE-2026-18447)

Harden more memory-size calculations against integer overflow (Álvaro Herrera) § § The PostgreSQL Project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem. (CVE-2026-120139)

Harden more memory-size calculations against integer overflow (Álvaro Herrera) § §

The PostgreSQL Project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem. (CVE-2026-120139)

Fix type confusion in set-returning functions that return RECORD , when materialized in a query's target list (Melanie Plageman, Robert Haas) § The same tuple descriptor was used across multiple calls, which is unsafe since the actual record type could vary. The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120141)

Fix type confusion in set-returning functions that return RECORD , when materialized in a query's target list (Melanie Plageman, Robert Haas) §

The same tuple descriptor was used across multiple calls, which is unsafe since the actual record type could vary.

The PostgreSQL Project thanks Peter Geoghegan for reporting this problem. (CVE-2026-120141)

Cope with concurrent rowtype changes in PL/pgSQL record field assignment (Tom Lane) § The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120151)

Cope with concurrent rowtype changes in PL/pgSQL record field assignment (Tom Lane) §

The PostgreSQL Project thanks Claude and Ada Logics for reporting this problem. (CVE-2026-120151)

Support “ tied ” Perl objects in PL/Perl and associated contrib modules (Andrey Rachitskiy) § Up to now, if you passed a tied object to a PL/Perl operation, it would most likely get treated as undef , since we failed to perform Perl get magic on values we're passed. Tied hashes worked partially, in that you could read out their keys, but the values always read as undef . Originally this was intended as a master-only change, since it looks like a feature addition. But afterwards we discovered that assorted security-grade misbehaviors could be triggered by tied objects even without this patch. Rather than trying to secure two sets of behaviors, it seems best to back-patch this change first. (CVE-2026-116326)

Support “ tied ” Perl objects in PL/Perl and associated contrib modules (Andrey Rachitskiy) §

Up to now, if you passed a tied object to a PL/Perl operation, it would most likely get treated as undef , since we failed to perform Perl get magic on values we're passed. Tied hashes worked partially, in that you could read out their keys, but the values always read as undef .

Originally this was intended as a master-only change, since it looks like a feature addition. But afterwards we discovered that assorted security-grade misbehaviors could be triggered by tied objects even without this patch. Rather than trying to secure two sets of behaviors, it seems best to back-patch this change first. (CVE-2026-116326)

Fix PL/Perl to cope with errors thrown from tied objects (Tom Lane, Andrew Dunstan) § § The PostgreSQL Project thanks Ngoc Tran, the Anthropic OSS program, and Dwij Mehta for reporting this problem. (CVE-2026-116326)

Fix PL/Perl to cope with errors thrown from tied objects (Tom Lane, Andrew Dunstan) § §

The PostgreSQL Project thanks Ngoc Tran, the Anthropic OSS program, and Dwij Mehta for reporting this problem. (CVE-2026-116326)

Fix type confusion in PL/Perl's get_perl_array_ref() (Andrew Dunstan) § The PostgreSQL Project thanks Zheng Yu for reporting this problem. (CVE-2026-116309)

Fix type confusion in PL/Perl's get_perl_array_ref() (Andrew Dunstan) §

The PostgreSQL Project thanks Zheng Yu for reporting this problem. (CVE-2026-116309)

Fix use-after-free in scans of Perl arrays and hashes (Tom Lane, Anthropic OSS program) § The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116320)

Fix use-after-free in scans of Perl arrays and hashes (Tom Lane, Anthropic OSS program) §

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116320)

Fix use-after-free in plperl_return_next_internal() (Anthropic OSS program) § The PostgreSQL Project thanks the Anthropic OSS program and Ngoc Tran for reporting this problem. (CVE-2026-116319)

Fix use-after-free in plperl_return_next_internal() (Anthropic OSS program) §

The PostgreSQL Project thanks the Anthropic OSS program and Ngoc Tran for reporting this problem. (CVE-2026-116319)

In PL/Perl, fix use-after-free triggered by releasing a prepared query that is being executed (Masahiko Sawada) § The PostgreSQL Project thanks Zheng Yu and the Anthropic OSS program for reporting this problem. (CVE-2026-116307)

In PL/Perl, fix use-after-free triggered by releasing a prepared query that is being executed (Masahiko Sawada) §

The PostgreSQL Project thanks Zheng Yu and the Anthropic OSS program for reporting this problem. (CVE-2026-116307)

Fix use-after-free hazards in re-entrant use of PL/Tcl (Tom Lane) § The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116323)

Fix use-after-free hazards in re-entrant use of PL/Tcl (Tom Lane) §

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116323)

Reject re-entrant use of contrib/dblink (Masahiko Sawada) § The PostgreSQL Project thanks Jiyong Ahn for reporting this problem. (CVE-2026-120147)

Reject re-entrant use of contrib/dblink (Masahiko Sawada) §

The PostgreSQL Project thanks Jiyong Ahn for reporting this problem. (CVE-2026-120147)

In contrib/dict_int , return NULL for zero-length tokens (Nathan Bossart, Anthropic OSS program) § This behavior is consistent with other text- dictionary types, and it avoids disclosure of server memory as was possible previously. The PostgreSQL Project thanks Nathan Bossart and the Anthropic OSS program for reporting this problem. (CVE-2026-116308)

In contrib/dict_int , return NULL for zero-length tokens (Nathan Bossart, Anthropic OSS program) §

This behavior is consistent with other text- dictionary types, and it avoids disclosure of server memory as was possible previously.

The PostgreSQL Project thanks Nathan Bossart and the Anthropic OSS program for reporting this problem. (CVE-2026-116308)

Ensure that reindexdb correctly quotes index names it is dealing with (Anthropic OSS program) § Crafted index names could yield a SQL-injection attack against the user running reindexdb . The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116325)

Ensure that reindexdb correctly quotes index names it is dealing with (Anthropic OSS program) §

Crafted index names could yield a SQL-injection attack against the user running reindexdb .

The PostgreSQL Project thanks the Anthropic OSS program for reporting this problem. (CVE-2026-116325)

Use fully-qualified operator names in vacuumdb (Nathan Bossart, Anthropic OSS program) § This prevents attacks on the user running vacuumdb . The PostgreSQL Project thanks Noah Misch and the Anthropic OSS program for reporting this problem. (CVE-2026-116313)

Use fully-qualified operator names in vacuumdb (Nathan Bossart, Anthropic OSS program) §

This prevents attacks on the user running vacuumdb .

The PostgreSQL Project thanks Noah Misch and the Anthropic OSS program for reporting this problem. (CVE-2026-116313)

Ensure that pg_dump quotes the names of NOT NULL constraints (Anthropic OSS program) § Its failure to do so in some cases risked SQL injection, or even just restoring the constraint with the wrong name. The PostgreSQL Project thanks the Anthropic OSS program, Sarath Kumar, and Nikolay Samokhvalov for reporting this problem. (CVE-2026-116318)

Ensure that pg_dump quotes the names of NOT NULL constraints (Anthropic OSS program) §

Its failure to do so in some cases risked SQL injection, or even just restoring the constraint with the wrong name.

The PostgreSQL Project thanks the Anthropic OSS program, Sarath Kumar, and Nikolay Samokhvalov for reporting this problem. (CVE-2026-116318)

Make the \[un]restrict commands functional in pg_dump 's tar-format output (Noah Misch) § This provides the intended level of protection to users who make use of the undocumented restore.sql tar member. The PostgreSQL Project thanks Pavel Kopylov for reporting this problem. (CVE-2026-116330)

Make the \[un]restrict commands functional in pg_dump 's tar-format output (Noah Misch) §

This provides the intended level of protection to users who make use of the undocumented restore.sql tar member.

The PostgreSQL Project thanks Pavel Kopylov for reporting this problem. (CVE-2026-116330)

Harden pg_restore against corrupt archive files (Dilip Kumar, Yonghwa Lee, Nathan Bossart) § This patch fixes out-of-bounds accesses and file path traversal hazards. There remain other issues that don't seem to amount to security bugs. The PostgreSQL Project thanks Dilip Kumar, Yonghwa Lee, OpenSec, and Ben Dixon for reporting this problem. (CVE-2026-116314)

Harden pg_restore against corrupt archive files (Dilip Kumar, Yonghwa Lee, Nathan Bossart) §

This patch fixes out-of-bounds accesses and file path traversal hazards. There remain other issues that don't seem to amount to security bugs.

The PostgreSQL Project thanks Dilip Kumar, Yonghwa Lee, OpenSec, and Ben Dixon for reporting this problem. (CVE-2026-116314)

Fix use of externally-controlled format string in pg_basebackup (Peter Eisentraut) § This problem could only be reached if files with unusual names exist in the server's data directory. The PostgreSQL Project thanks Peter Eisentraut for reporting this problem. (CVE-2026-16240)

Fix use of externally-controlled format string in pg_basebackup (Peter Eisentraut) §

This problem could only be reached if files with unusual names exist in the server's data directory.

The PostgreSQL Project thanks Peter Eisentraut for reporting this problem. (CVE-2026-16240)

Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) § Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results. This patch disables de-duplication for new index entries, but does nothing possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update. Note that this problem only applies to columns declared as bpchar , that is, lacking any length constraint. The more common usage of CHAR( n ) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Disable btree index de-duplication support for the bpchar data type (Shihao Zhong, Peter Geoghegan) §

Index de-duplication is unsafe for bpchar because its notion of equality is weaker than bitwise equality. In particular, because bpchar equality ignores trailing spaces, values of different lengths can compare equal. De-duplication then allows index-only scans to return subtly wrong results.

This patch disables de-duplication for new index entries, but does nothing possible corruption of existing entries. Therefore, users who have btree indexes on bpchar columns should REINDEX them after installing this update.

Note that this problem only applies to columns declared as bpchar , that is, lacking any length constraint. The more common usage of CHAR( n ) is not at risk, even though it shares the same underlying code, because the length constraint forces otherwise-equal strings to have the same length and thus to be bitwise equal.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § § When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Ensure that VACUUM cleans up all dead tuples in a GIN index (Peter Geoghegan) § §

When a single VACUUM operation requires multiple index scans (because it is removing more tuples than it can hold in memory at once), it was possible to miss removing some index entries that should be removed. An additional bug involving a race with leaf page splits had the same effect. These bugs would eventually lead to a corrupt index with entries pointing at unrelated table rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) § The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix GIN posting tree page deletion after an incomplete page split (Peter Geoghegan) §

The deletion step could incorrectly disconnect sibling pages, causing subsequent index searches to miss rows. REINDEX is recommended if you suspect this has happened.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) § REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors “ missing chunk number ” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Fix failure to update mutable pg_index fields for TOAST-table indexes (Bharath Rupireddy) §

REINDEX CONCURRENTLY can change these fields, but the relation cache was not expecting that, allowing index updates to be missed. The end result could be errors “ missing chunk number ” due to missing index entries. Fortunately, these only represent index corruption; the TOAST table itself is fine, so a REINDEX will suffice to recover.

Perform join removal by editing the query's parse tree, rather than trying to fix up the planner's derived data structures (Tom Lane, Richard Guo, Shihao Zhong, Ayush Tiwari) § § § § § § § § § The original implementation of join removal in the planner has had numerous bugs over the years, including some that were never fixed. It was inherently fragile because changes in the planner's derived data structures often required adjustments in join removal, yet there was no easy way to keep that code in sync. Replace it with code that modifies the far-simpler parse tree representation and then loops around to re-generate all of the derived data. This is a significant change that normally we'd never consider back-patching, but the prospect of continuing bugs from the old implementation has driven us to take the risk of doing so.

Perform join removal by editing the query's parse tree, rather than trying to fix up the planner's derived data structures (Tom Lane, Richard Guo, Shihao Zhong, Ayush Tiwari) § § § § § § § § §

The original implementation of join removal in the planner has had numerous bugs over the years, including some that were never fixed. It was inherently fragile because changes in the planner's derived data structures often required adjustments in join removal, yet there was no easy way to keep that code in sync. Replace it with code that modifies the far-simpler parse tree representation and then loops around to re-generate all of the derived data. This is a significant change that normally we'd never consider back-patching, but the prospect of continuing bugs from the old implementation has driven us to take the risk of doing so.

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § § § § § § § § These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “ failed to build any N-way joins ” .

Fix assorted planner bugs triggered by lateral references (Richard Guo) § § § § § § § § § § §

These mistakes could lead to incorrect query plans causing wrong answers, or to internal planner errors such as “ failed to build any N-way joins ” .

Ensure proper placement of qual clauses containing PlaceHolderVars by assigning a relation ID to antijoins made from SubLinks (Richard Guo) § This avoids edge cases where such a qual could be pushed into the right-hand side of the antijoin, giving it the opposite of the desired semantics.

Ensure proper placement of qual clauses containing PlaceHolderVars by assigning a relation ID to antijoins made from SubLinks (Richard Guo) §

This avoids edge cases where such a qual could be pushed into the right-hand side of the antijoin, giving it the opposite of the desired semantics.

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) § § In rare cases, planning could fail with “ failed to assign all NestLoopParams to plan nodes ” , “ plan should not reference subplan's variable ” , or “ variable not found in subplan target list ” errors.

Fix placement of PlaceHolderVars as nestloop parameters (Richard Guo) § §

In rare cases, planning could fail with “ failed to assign all NestLoopParams to plan nodes ” , “ plan should not reference subplan's variable ” , or “ variable not found in subplan target list ” errors.

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § § Depending on the plan shape selected, such cases could produce wrong results, or could fail with “ variable not found in subplan target lists ” .

Avoid planner failure for sort keys that are PlaceHolderVars (Richard Guo) § §

Depending on the plan shape selected, such cases could produce wrong results, or could fail with “ variable not found in subplan target lists ” .

Fix incorrect dropping of outer join clauses after re-associating outer joins (Richard Guo, Nitin Motiani) §

Fix incorrect dropping of outer join clauses after re-associating outer joins (Richard Guo, Nitin Motiani) §

Avoid “ unsupported join alias expression ” failures when a whole-row Var references a join and appears below an outer join (Richard Guo) §

Avoid “ unsupported join alias expression ” failures when a whole-row Var references a join and appears below an outer join (Richard Guo) §

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) § This oversight led to errors like “ cannot handle unplanned sub-select ” or “ unrecognized node type ” .

Handle SubLinks correctly when expanding a whole-row join alias reference (Richard Guo) §

This oversight led to errors like “ cannot handle unplanned sub-select ” or “ unrecognized node type ” .

Do not perform self-join elimination with inheritance trees (Tender Wang) § In traditional table inheritance, a unique index on the parent table isn't sufficient to prove uniqueness across its children too, so that the proof required for SJE isn't possible. Moreover, the code was willing to merge parent_table with parent_table ONLY , which doesn't even represent the same set of rows.

Do not perform self-join elimination with inheritance trees (Tender Wang) §

In traditional table inheritance, a unique index on the parent table isn't sufficient to prove uniqueness across its children too, so that the proof required for SJE isn't possible. Moreover, the code was willing to merge parent_table with parent_table ONLY , which doesn't even represent the same set of rows.

In self-join elimination, check that clauses used to prove uniqueness actually match (Tender Wang) § Previously, this code assumed that equality clauses with the same operands were equivalent; but in fact they could use different equality operators, or more likely different collations.

In self-join elimination, check that clauses used to prove uniqueness actually match (Tender Wang) §

Previously, this code assumed that equality clauses with the same operands were equivalent; but in fact they could use different equality operators, or more likely different collations.

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) § This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Don't assume that DISTINCT ON ensures uniqueness of a subquery's output rows when the subquery's targetlist contains any set-returning functions (Richard Guo) §

This doesn't follow, because the set-returning functions may be evaluated after the de-duplication step.

Fix incorrect constant-folding of a JSON constructor with a RETURNING clause inside a simple-form CASE with a constant test expression (Richard Guo) §

Fix incorrect constant-folding of a JSON constructor with a RETURNING clause inside a simple-form CASE with a constant test expression (Richard Guo) §

Fix test for pushing WHERE clauses down past a grouping step that has a different equivalence rule (Richard Guo) § The release cycle's fix for this situation misbehaved for some clauses involving CASE expressions.

Fix test for pushing WHERE clauses down past a grouping step that has a different equivalence rule (Richard Guo) §

The release cycle's fix for this situation misbehaved for some clauses involving CASE expressions.

Fix incorrect behavior of MIN() / MAX() index scans when query specifies FETCH ... WITH TIES (Chaitanya Choudhary) § The WITH TIES option was accidentally copied into the sub-SELECT generated to perform the index scan, possibly triggering “ more than one row returned by a subquery us...