PostgreSQL patches 52 vulnerabilities, 32 enabling code execution, in 18.7, 17.12, 16.16, 15.20 and 14.25 (14 now EOL)
Matéria consolidada. Reúne 4 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 14/11/2026 00:02; os links antigos trazem para cá.
Fontes: thehackernews.com ↗ cert.cyber.gouv.fr ↗ securityonline.info ↗ helpnetsecurity.com ↗
On November 12, 2026, the PostgreSQL Global Development Group released security updates 18.7, 17.12, 16.16, 15.20 and 14.25, fixing 52 vulnerabilities and over 140 bugs across PostgreSQL 18 to 14 (helpnetsecurity.com, securityonline.info). Of these, 32 flaws let authenticated database users or users with object creation privileges execute arbitrary code as the operating system user running PostgreSQL, a significant risk in multi-tenant or hosted environments (securityonline.info). The 32 high-severity CVEs are rated CVSS 8.8 (helpnetsecurity.com), and the highest-severity CVE named is CVE-2026-6460 at 8.8 (securityonline.info). On November 13, CERT-FR (cert.cyber.gouv.fr) issued an advisory describing the flaws as critical and remotely exploitable, enabling RCE, remote denial of service, security policy bypass and loss of data confidentiality; it lists over thirty CVEs, including CVE-2026-116303 and CVE-2026-120139. No active exploitation or public proof-of-concept has been confirmed (securityonline.info). PostgreSQL 14.25 is the final release of that branch, which reaches end-of-life and is no longer supported, so administrators need a migration plan (helpnetsecurity.com, securityonline.info, cert.cyber.gouv.fr).
Entenda a falha
A vulnerabilidade
PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, released on November 12, 2026, fix 52 CVEs, 32 of them CVSS 8.8. The lead one is CVE-2026-6460, a type confusion in composite types: a database user who can create or modify objects can run code as the OS user running PostgreSQL. All earlier releases are affected, and CERT-FR also lists 19 before RC 2. 14.25 is the last release of the now end-of-life branch 14. Others: CVE-2026-120141 and CVE-2026-120139 (ordinary login is enough), CVE-2026-120145 (a compromised publisher attacks a subscriber, only when a superuser owns the subscription), CVE-2026-120149 (hostile foreign server), CVE-2026-116314 (crafted archive makes pg_restore run code) and CVE-2026-116322, the only server flaw needing no login, which lets an unauthenticated client restart PostgreSQL 18. C-language extensions must be rebuilt.
Como funciona
For CVE-2026-6460, a composite type is built from named fields, each with its own data type. A field's type can be changed while older values of that type are still held elsewhere in the server, for example in a prepared query. When the query later runs, the server reads the old value as if it had the new type. This corrupts memory inside the server process, which runs as the OS user. Other flaws follow a similar memory-error pattern in PL/Perl, PL/Tcl, triggers, dblink, text search functions, parallel query, logical replication and statistics import. In client tools, a crafted archive can make pg_restore run code, and a compromised source server can make psql run code through the restore script in pg_dump's tar output.
Por que é vulnerável
The root of CVE-2026-6460 is that the server did not detect that a stored composite value no longer matched its type after a column's type was changed. Per the researcher, it dates to May 5, 2004, when PostgreSQL gained the ability to change a column's type, and his code execution technique relies on a later change of May 14, 2015. The fix, per the release notes, adds version checks so the server can detect a value that no longer matches its type. Most other flaws are memory errors (use-after-free, buffer overflows) and injection or quoting issues in client tools. A new composite_type_mismatch setting can turn the checks off, but the project warns of security risks.
Onde está
The articles name components, not files: composite type handling in the server, PL/Perl, PL/Tcl, triggers, dblink, ts_rank_cd(), and the pg_dump, pg_restore, reindexdb and vacuumdb tools, plus the new composite_type_mismatch setting.
Como foi descoberta
The project credits more than a dozen reporters for CVE-2026-6460, among them security researcher Mehmet Ince, who is also credited on five other flaws in the release. He published a technical writeup this week. In August he privately shared proofs of concept adapted for managed services with the security teams of AWS (Aurora and RDS), Microsoft (Azure PostgreSQL), Google (AlloyDB), Supabase, Databricks and Ubicloud. The project and CISA's CVE record report no exploitation in the wild.
PoC pública
Mehmet Ince's public writeup describes a working exploit for CVE-2026-6460, demonstrated on PostgreSQL 18.6. It shows how to prepare a query, change a field's type and run it, and includes the SQL that crashes an unpatched server and a second step that leaks memory addresses. It omits the SQL for the final step that makes the server run a command. He says he triggered the crash as a lowest-privileged login role, but the sources do not say whether a default-privilege account can reach code execution. Since most of the chain is public, patch urgently; the story's claim of no public PoC conflicts with this article.
Explicação gerada por IA a partir da matéria e dos artigos, em 14/11/2026 00:18.
Detalhes técnicos
- Most code execution flaws come from memory errors and type confusion, including use-after-free and buffer overflows (helpnetsecurity.com, securityonline.info).
- Affected components include PL/Perl, PL/Tcl, triggers, dblink and various query functions (helpnetsecurity.com, securityonline.info).
- Client tools such as pg_dump, pg_restore and reindexdb are patched for injection and quoting issues (helpnetsecurity.com, securityonline.info).
- Some bugs enable unusual attack vectors, such as a compromised publisher attacking subscribers or a hostile foreign server attacking a querying database (securityonline.info).
- PostgreSQL 19 RC 2 was also released. It reverts support for some JSON functions, so schema adjustments are needed before upgrading (helpnetsecurity.com).
- CERT-FR lists the affected versions as all releases prior to 15.20, 16.16, 17.12, 18.7 and 19 RC 2, and prior to 14.25 (the latter being end of life). It classes the impact as RCE, remote DoS, security policy bypass and compromise of data confidentiality (cert.cyber.gouv.fr).
Detalhes da correção
- The patch for CVE-2026-6460 adds version checks to composite types to prevent reading old values as new types, preventing the type confusion exploit (thehackernews.com).
- Rebuilding or updating all C-language extensions is mandatory, as these may not be protected by the fix if built against older releases, sometimes requiring source code changes (thehackernews.com).
Remediação
- Apply the updates immediately to the latest minor releases (18.7, 17.12, 16.16, 15.20, 14.25) (thehackernews.com). CERT-FR recommends immediate upgrade to supported versions 15.20, 16.16, 17.12, 18.7 or 19 RC 2, and points to the official PostgreSQL security bulletin for specific patching instructions (cert.cyber.gouv.fr).
- Plan migration off PostgreSQL 14, since 14.25 is the last release of the branch (helpnetsecurity.com, cert.cyber.gouv.fr).
- Rebuild C-language extensions and update client tools like pg_dump, pg_restore, reindexdb, and vacuumdb (thehackernews.com).
- Follow reindexing steps and fresh full backups if using incremental backups (thehackernews.com).
- Avoid disabling the composite_type_mismatch security check as it carries risks (thehackernews.com).
Relatos divergentes
- Severity and attack preconditions: CERT-FR (cert.cyber.gouv.fr) describes the vulnerabilities as critical and remote, including RCE and remote DoS, while helpnetsecurity.com rates the 32 high-severity CVEs at CVSS 8.8 and securityonline.info says exploitation requires authenticated users or users with object creation privileges. The vendor-aligned CVSS scores and the detailed analysis are more specific; the CERT-FR wording is a general characterization.
- Number of CVEs: helpnetsecurity.com and securityonline.info count 52 vulnerabilities, whereas CERT-FR (cert.cyber.gouv.fr), the most recent source, cites only "over thirty" CVEs. The sources do not reconcile the figures; the 52 count covers all fixed vulnerabilities, while CERT-FR's list may be limited to the most severe.
- Named CVEs: securityonline.info names CVE-2026-6460 as the highest severity, whereas CERT-FR cites CVE-2026-116303 and CVE-2026-120139 as examples; the sources do not relate these identifiers to each other.
Linha do tempo
-
PostgreSQL fixes 22-year-old authenticated RCE type confusion vulnerability and 51 other flaws
This article provides detailed technical insight into the exploitation method of CVE-2026-6460, crediting researcher Mehmet Ince for a working exploit demonstrated on PostgreSQL 18.6 and describing the root causes dating back to 2004 and 2015. It highlights collaboration with major cloud providers on managed PostgreSQL services and emphasizes rebuilding C-language extensions as a critical remediation step not previously detailed. It also clarifies that no exploitation in the wild has been observed by the PostgreSQL Global Development Group or CISA.
ler a análise desta fonte ocultar
This article provides detailed technical insight into the exploitation method of CVE-2026-6460, crediting researcher Mehmet Ince for a working exploit demonstrated on PostgreSQL 18.6 and describing the root causes dating back to 2004 and 2015. It highlights collaboration with major cloud providers on managed PostgreSQL services and emphasizes rebuilding C-language extensions as a critical remediation step not previously detailed. It also clarifies that no exploitation in the wild has been observed by the PostgreSQL Global Development Group or CISA.
The PostgreSQL Global Development Group released updates addressing 52 security flaws, including a critical type confusion vulnerability (CVE-2026-6460) that enables authenticated database users with object creation privileges to execute arbitrary code as the OS user running PostgreSQL. This vulnerability, present in all pre-18.7, 17.12, 16.16, 15.20, and 14.25 versions, traces back to a 2004 feature and exploits composite type mismatches. No exploitation in the wild has been reported. Full mitigation requires rebuilding any C-language extensions due to potential residual vulnerabilities in older builds. Client tools also received patches for code execution attacks via crafted archives. Administrators are urged to update to the latest minor releases for their version, rebuild extensions, update client tools, reindex affected data, and avoid disabling new security checks via the composite_type_mismatch setting. PostgreSQL 14 has reached EOL with 14.25 as its final patch release.
-
Multiple critical remote vulnerabilities disclosed in PostgreSQL allowing RCE, data breach, and DoS
ler a análise desta fonte ocultar
Multiple critical security vulnerabilities have been identified in PostgreSQL versions prior to 15.20, 16.16, 17.12, 18.7, 19 RC 2, and before 14.25, the latter of which has reached end of life and is no longer supported. These vulnerabilities allow attackers to perform remote code execution (RCE), cause remote denial of service (DoS), bypass security policies, and compromise data confidentiality. The PostgreSQL project released patches on November 12, 2026, addressing these issues. Immediate upgrade to supported versions including 15.20, 16.16, 17.12, 18.7, and 19 RC 2 is recommended to mitigate exploitation risks. The detailed list includes over thirty CVEs such as CVE-2026-116303 and CVE-2026-120139. Users are advised to consult the official PostgreSQL security bulletin for specific patching instructions.
-
PostgreSQL fixes 52 vulnerabilities including critical arbitrary code execution across multiple versions
ler a análise desta fonte ocultar
On November 12, 2026, PostgreSQL released versions 18.7, 17.12, 16.16, 15.20, and 14.25 addressing 52 security vulnerabilities. Of these, 32 flaws allow authenticated database users or users with object creation privileges to execute arbitrary code as the operating system user running PostgreSQL, posing significant risks especially in multi-tenant or hosted environments. The highest severity CVE (CVE-2026-6460) scores 8.8 (High CVSSv3). Notably, PostgreSQL 14 reaches end-of-life with this release and will no longer receive patches. No active exploitation or public proof-of-concept has yet been confirmed. The vulnerabilities include common memory corruption issues such as type confusion, use-after-free, and buffer overflows, affecting core database features including PL/Perl, PL/Tcl languages, triggers, dblink, and client tools like pg_dump and pg_restore. Certain bugs enable unusual attack vectors, such as compromised publishers attacking subscribers or hostile foreign servers attacking querying databases. Immediate application of these updates is recommended, along with auditing users with CREATE privileges and reindexing affected indexes. Planning migration off PostgreSQL 14 is advised as PostgreSQL 19 is upcoming.
-
PostgreSQL fixes 52 vulnerabilities including critical code execution bugs in major release update
ler a análise desta fonte ocultar
On November 12, 2026, the PostgreSQL Global Development Group released critical security updates fixing 52 vulnerabilities and over 140 bugs across PostgreSQL versions 18 to 14. The majority of code execution flaws stem from memory errors and type confusion affecting components like PL/Perl, PL/Tcl, and various query functions, with 32 CVEs rated at a high CVSS score of 8.8. Client tools such as pg_dump and reindexdb are also patched due to injection and quoting issues. Administrators are advised to perform reindexing on specific indexes and update client binaries. PostgreSQL 14.25 is the final release of that branch, requiring plans to upgrade as it will no longer receive support. Additionally, PostgreSQL 19 RC 2 was released, reverting some JSON functions support requiring schema adjustments before upgrade.