PostgreSQL fixes 52 vulnerabilities including critical code execution bugs in major release update

Entenda a falha

A vulnerabilidade

PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 fix 52 security vulnerabilities (no CVE IDs are listed in the story) and more than 140 other bugs. Most of the code execution flaws are memory errors or type confusion in PL/Perl, PL/Tcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import. 32 of the 52 CVEs score CVSS 8.8, the highest in the batch; the lowest, a bypass of the EXECUTE privilege on cast functions, scores 3.1. The client tools are also affected: pg_dump has a SQL injection through not-null constraint names and a tar-format restore script that does not block psql command injection, and reindexdb mishandles quoting of index names. The articles do not say what privileges an attacker needs. The client-tool issues matter where other users can create and name database objects.

Como funciona

The articles give no step-by-step detail for individual flaws. For the memory and type-confusion bugs, a value reaches a server component such as a procedural language, a text search function or a replication or statistics path, and PostgreSQL handles it as the wrong data type or misuses memory, which can lead to code execution. In the client tools, object names such as not-null constraint names or index names are placed into SQL or psql commands without proper quoting or escaping, so a name chosen by another database user can be interpreted as commands when an administrator runs pg_dump, a tar-format restore or reindexdb.

Por que é vulnerável

For the server flaws, the articles point to memory errors and type confusion, where a value is handled as the wrong data type. For the client tools, the cause is missing or incorrect quoting and escaping of object names (not-null constraint names in pg_dump, index names in reindexdb) and a tar-format restore script that did not block psql command injection. The articles do not explain why these went unnoticed. The fix is the new minor releases, which also fix several bugs that could corrupt indexes and incremental backups.

Onde está

The articles name the affected components, not files or commits: PL/Perl, PL/Tcl, ts_rank_cd(), parallel query, logical replication, dblink, statistics import, pg_dump (including its tar-format restore script) and reindexdb.

Como foi descoberta

The articles do not say who found the flaws or how. They only report that the PostgreSQL Global Development Group published the fixes on November 12, 2026 as a coordinated batch of minor releases covering versions 18 to 14. PostgreSQL 14.25 is the last release of the 14 branch.

Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 22:17.