PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 are out, along with 19 RC2, to fix 52 security issues, Phoronix reports. Phoronix ties the flood partly to AI-driven bug reports, the same pile that’s been pushing PostgreSQL 19 behind schedule.
Several are rated CVSS 8.8, mostly code execution through type confusion or use-after-free:
- Type confusion after
ALTER ... SET DATA TYPE(CVE-2026-6460) - Output parameter type confusion (CVE-2026-18447)
- Parallel RECORD typmod use-after-free (CVE-2026-116304)
- Two plperl bugs (CVE-2026-116307, CVE-2026-116309)
dblinkand subscriptions able to append to arbitrary files (CVE-2026-14661, 8.1)
What to do
Update to the new minor release for your branch. Minor updates don’t need a dump and restore, just the new binaries and a restart. If you use plperl or dblink, move those servers to the top of the list.
My take
Fifty-two CVEs in one drop is what the AI bug-hunting era looks like for a mature project. It isn’t a sign PostgreSQL got worse. It’s a sign more people, and more models, are looking.
God Bless, and May the Source Be with You!
