PostgreSQL patches 52 vulnerabilities, 32 enabling code execution, in 18.7, 17.12, 16.16, 15.20 and 14.25 (14 now EOL)
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 13/11/2026 12:02; os links antigos trazem para cá.
On November 12, 2026, the PostgreSQL Global Development Group released security updates 18.7, 17.12, 16.16, 15.20 and 14.25, fixing 52 vulnerabilities and over 140 bugs across PostgreSQL 18 to 14 (helpnetsecurity.com, securityonline.info). Of these, 32 flaws let authenticated database users or users with object creation privileges execute arbitrary code as the operating system user running PostgreSQL, a significant risk in multi-tenant or hosted environments (securityonline.info). The 32 high-severity CVEs are rated CVSS 8.8 (helpnetsecurity.com), and the highest-severity CVE named is CVE-2026-6460 at 8.8 (securityonline.info). No active exploitation or public proof-of-concept has been confirmed (securityonline.info). PostgreSQL 14.25 is the final release of that branch, which reaches end-of-life, so administrators need a migration plan (helpnetsecurity.com, securityonline.info).
Entenda a falha
A vulnerabilidade
PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, released on November 12, 2026, fix 52 CVEs: 38 High, 12 Medium and 2 Low. Thirty-two score CVSS 8.8 and let an authenticated user, often one who can create objects, run code as the operating system account running PostgreSQL. The top one named is CVE-2026-6460, a type confusion reached through DDL. CVE-2026-120141 and CVE-2026-120139 need only an ordinary login. CVE-2026-120145 lets a compromised publisher attack a subscriber when a superuser owns the subscription, and CVE-2026-120149 lets a hostile foreign server attack the database querying it. CVE-2026-116314 is code execution via crafted archives in pg_restore. CVE-2026-116322 lets an unauthenticated client force a server restart on version 18, and CVE-2026-116329 and CVE-2026-116318 affect only version 18. All branches before the fixed releases are affected. The lowest score, 3.1, is a bypass of the EXECUTE privilege on cast functions.
Como funciona
For CVE-2026-6460, a user who can create objects changes a column's data type. The server keeps stale values stored under the old type and later treats them as the new one, which is the type confusion. That corrupts memory inside the server process, which runs as the operating system user. Other flaws follow the same pattern in PL/Perl, PL/Tcl, triggers, dblink, text search functions such as ts_rank_cd(), parallel query, logical replication and statistics import. In replication and foreign-server cases the direction is reversed: the remote side sends data the receiving database handles unsafely. In the client tools, pg_dump builds SQL from not-null constraint names, its tar-format restore script did not block psql command injection, and reindexdb mishandled quoting of index names.
Por que é vulnerável
Most flaws are memory-safety bugs: type confusion, use-after-free and buffer overflows. The rest include SQL injection and search path flaws in pg_dump, reindexdb and vacuumdb, row-level security bypasses and privilege checks that roles can skip. The common wrong assumption was that data from users, remote servers or archives could be handled safely. The advisory says other DDL attack routes exist for CVE-2026-6460. The articles do not detail what each fix changes; they say only that stopping PostgreSQL and updating the binaries is enough, with no dump and reload.
Onde está
The articles name components, not files: PL/Perl, PL/Tcl, triggers, dblink, text search (ts_rank_cd()), parallel query, logical replication, statistics import, and the pg_dump, pg_restore, reindexdb and vacuumdb tools.
Como foi descoberta
The articles do not say who found the flaws or how. They report only that the PostgreSQL project published the fixes and an advisory on November 12, 2026. SecurityOnline notes the batch is far larger than recent ones, since HeroDevs counted 28 fixes in the August release. No exploitation in the wild has been confirmed.
Explicação gerada por IA a partir da matéria e dos artigos, em 13/11/2026 12:18.
Detalhes técnicos
- Most code execution flaws come from memory errors and type confusion, including use-after-free and buffer overflows (helpnetsecurity.com, securityonline.info).
- Affected components include PL/Perl, PL/Tcl, triggers, dblink and various query functions (helpnetsecurity.com, securityonline.info).
- Client tools such as pg_dump, pg_restore and reindexdb are patched for injection and quoting issues (helpnetsecurity.com, securityonline.info).
- Some bugs enable unusual attack vectors, such as a compromised publisher attacking subscribers or a hostile foreign server attacking a querying database (securityonline.info).
- PostgreSQL 19 RC 2 was also released. It reverts support for some JSON functions, so schema adjustments are needed before upgrading (helpnetsecurity.com).
Remediação
- Apply the updates immediately (securityonline.info).
- Reindex the specific affected indexes and update client binaries (helpnetsecurity.com, securityonline.info).
- Audit users holding CREATE privileges (securityonline.info).
- Plan migration off PostgreSQL 14, which will no longer receive patches (helpnetsecurity.com, securityonline.info).
Linha do tempo
-
PostgreSQL fixes 52 vulnerabilities including critical arbitrary code execution across multiple versions
ler a análise desta fonte ocultar
On November 12, 2026, PostgreSQL released versions 18.7, 17.12, 16.16, 15.20, and 14.25 addressing 52 security vulnerabilities. Of these, 32 flaws allow authenticated database users or users with object creation privileges to execute arbitrary code as the operating system user running PostgreSQL, posing significant risks especially in multi-tenant or hosted environments. The highest severity CVE (CVE-2026-6460) scores 8.8 (High CVSSv3). Notably, PostgreSQL 14 reaches end-of-life with this release and will no longer receive patches. No active exploitation or public proof-of-concept has yet been confirmed. The vulnerabilities include common memory corruption issues such as type confusion, use-after-free, and buffer overflows, affecting core database features including PL/Perl, PL/Tcl languages, triggers, dblink, and client tools like pg_dump and pg_restore. Certain bugs enable unusual attack vectors, such as compromised publishers attacking subscribers or hostile foreign servers attacking querying databases. Immediate application of these updates is recommended, along with auditing users with CREATE privileges and reindexing affected indexes. Planning migration off PostgreSQL 14 is advised as PostgreSQL 19 is upcoming.
-
PostgreSQL fixes 52 vulnerabilities including critical code execution bugs in major release update
ler a análise desta fonte ocultar
On November 12, 2026, the PostgreSQL Global Development Group released critical security updates fixing 52 vulnerabilities and over 140 bugs across PostgreSQL versions 18 to 14. The majority of code execution flaws stem from memory errors and type confusion affecting components like PL/Perl, PL/Tcl, and various query functions, with 32 CVEs rated at a high CVSS score of 8.8. Client tools such as pg_dump and reindexdb are also patched due to injection and quoting issues. Administrators are advised to perform reindexing on specific indexes and update client binaries. PostgreSQL 14.25 is the final release of that branch, requiring plans to upgrade as it will no longer receive support. Additionally, PostgreSQL 19 RC 2 was released, reverting some JSON functions support requiring schema adjustments before upgrade.