PostgreSQL Patches 52 Security Flaws, but a Key Fix Also Requires Rebuilding C Extensions

PostgreSQL has patched 52 security vulnerabilities in a release that asks database operators to do more than install new binaries. One code execution fix also requires rebuilding C-language extensions for full protection, and some extensions will need changes to their source code.

The November 12 update covers versions 18.7, 17.12, 16.16, 15.20 and 14.25, alongside a second release candidate for PostgreSQL 19. The project also fixed more than 140 bugs.

A database permission can become server access

One of the flaws, CVE-2026-6460, lets a user who can create database objects execute code with the privileges of the operating system account running PostgreSQL. The project assigns it a severity score of 8.8 out of 10. Earlier releases across the five patched major versions are affected.

The underlying problem is type confusion: PostgreSQL could interpret a stored value using the wrong description of its structure after a type change. That makes the ability to create objects a security boundary with consequences outside the database itself.

The 18.7 release notes describe new checks that detect composite values whose structure no longer matches what the database expects. Those checks require the extension rebuilds. A server setting can disable them, but the maintainers warn that doing so carries security risks.

Backups and old installations need attention too

The release notes also warn that existing incremental backups may be corrupt. They recommend taking a new full backup after updating and using it as the starting point for future incremental backups. Operators may also need to rebuild affected indexes; updating the software alone does not repair an already damaged index.

For PostgreSQL 14 installations, this patch is the last one. Version 14 has reached end of life and will receive no further security or bug fixes. Moving to a newer supported major version is now part of keeping those databases maintained.

Some offers on this page may be paid placements or contain affiliate links.