PostgreSQL 18.7 Patches 52 Security Vulnerabilities and 140+ Bugs as PostgreSQL 14 Reaches End of Life

Executive Summary

On November 12, 2026, the PostgreSQL Global Development Group (PGDG) released a coordinated cumulative update across every supported production branch: PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25, alongside PostgreSQL 19 RC 2. The release closes 52 security vulnerabilities and resolves over 140 bugs reported over the preceding months.

Three operational realities define this release for database administrators and systems engineers:

1. High-Density Code Execution Surface: Thirty-two of the 52 patched CVEs carry a CVSS v3.1 score of 8.8, driven primarily by type-confusion, use-after-free, and heap buffer overflow flaws across core execution paths, PL/Perl, PL/Tcl, text search functions, logical replication, and client utilities (pg_dump, pg_restore, reindexdb, and vacuumdb). The lowest-scored flaw in the batch carries a CVSS v3.1 score of 3.1.
2. PostgreSQL 14 Permanent End of Life (EOL): Version 14.25 is the final upstream community release for the PostgreSQL 14 branch. Effective November 12, 2026, PostgreSQL 14 receives zero future security patches or data-corruption bug fixes from PGDG.
3. Mandatory Post-Update Integrity Repairs: Applying the minor binary update is not sufficient on its own for every cluster. The release fixes multiple silent data-integrity bugs affecting GIN indexes, pg_trgm GiST indexes, B-tree indexes on lengthless bpchar columns, TOAST tables, partitioned NOT NULL NO INHERIT constraints, and incremental backups, each requiring targeted post-update verification or reindexing.

Additionally, PostgreSQL 19 RC 2 ships with all applicable security and correctness fixes, ahead of a planned General Availability (GA) date of November 19, 2026.

---

Release Matrix and Lifecycle Timeline

Every maintained major branch received a simultaneous patch on November 12, 2026. Minor releases are cumulative, meaning administrators can stop the database service, upgrade binaries, and restart without running pg_upgrade or a dump/restore cycle—provided they review any skipped prior minor release notes.

+-----------------------------------------------------------------------------+
|                POSTGRESQL NOVEMBER 12, 2026 RELEASE & LIFECYCLE             |
+-----------------------------------------------------------------------------+
|                                                                             |
|  [ PG 14.25 ] ---> PERMANENT COMMUNITY EOL (Nov 12, 2026)                   |
|                    Zero future upstream CVE or corruption patches           |
|                    (Amazon RDS standard support ends Feb 28, 2027)          |
|                                                                             |
|  [ PG 15.20 | 16.16 | 17.12 | 18.7 ]                                        |
|       |                                                                     |
|       +---> Stop PostgreSQL ---> Upgrade Server + Client Binaries           |
|       |                                                                     |
|       +---> Post-Update Repair Gate:                                        |
|               |-- GIN / pg_trgm GiST / bpchar B-tree ---> REINDEX           |
|               |-- Partitioned NOT NULL NO INHERIT   ---> ALTER / DROP       |
|               +-- Incremental Backup Chains         ---> New Full Backup    |
|                                                                             |
|  [ PG 19 RC 2 ] ---> Planned GA: Nov 19, 2026                               |
|                      (Reverts JSON_ARRAY/JSON_OBJECT index & key support)   |
+-----------------------------------------------------------------------------+

---

Technical Mechanics: Vulnerability Classes and Attack Surface

Across the 52 CVEs disclosed in the November 12 advisory and analyzed by Help Net Security and Brandefense, the majority of high-severity flaws do not allow unauthenticated network-level zero-click exploitation. Instead, they allow an authenticated user with object-creation or query-execution privileges—or an attacker abusing a multi-tenant or compromised application service role—to escalate to arbitrary code execution as the database operating system user (typically postgres).

1. Type Confusion and Stale Type-Cache Invalidation (CVSS 8.8)

Several of the highest-impact vulnerabilities stem from PostgreSQL failing to re-validate or invalidate cached data types when underlying table schemas or composite structures mutate mid-session:

• CVE-2026-6460 (CVSS v3.1: 8.8): Type confusion following ALTER ... SET DATA TYPE allows stale typed values in system entries and variables, enabling arbitrary code execution.
• CVE-2026-18447 (CVSS v3.1: 8.8): Output parameter type confusion executes arbitrary code.
• CVE-2026-120141 (CVSS v3.1: 8.8): Materialized set-returning function type confusion executes arbitrary code.
• Additional Type-Confusion Entries (CVSS v3.1: 8.8): CVE-2026-116306 (composite-type change during field assignment), CVE-2026-116329 (statistics import), CVE-2026-116331 (min/max aggregate), CVE-2026-116335 (commutator/negator result-type confusion), CVE-2026-120142 (dropped-column type confusion), CVE-2026-120144 (type-cache invalidation gap), and CVE-2026-120151 (plpgsql record-field type confusion).

+-----------------------------------------------------------------------------+
|             DEFENSIVE MODEL: TYPE CONFUSION & RE-VALIDATION BOUNDARY        |
+-----------------------------------------------------------------------------+
|  [ Unpatched Flow ]                                                         |
|   Session caches TupleDesc / TypeOID ---> DDL mutates column (ALTER TYPE)   |
|   ---> Cached pointer read with mismatched memory layout ---> Code Exec     |
|                                                                             |
|  [ Patched 18.7 / 17.12+ Flow ]                                             |
|   Session caches TupleDesc / TypeOID ---> DDL mutates column                |
|   ---> Type-cache invalidation callback fires ---> Re-fetches Typmod/OID    |
|   ---> Layout verified before dereference ---> Safe execution or clean error|
+-----------------------------------------------------------------------------+

2. Memory Safety: Use-After-Free, Heap Overflows, and Integer Wraparound (CVSS 8.8)

Memory corruption bugs appear across procedural languages, full-text search, parallel query workers, and internal allocators:

• PL/Perl and PL/Tcl Reentrancy: CVE-2026-116307, CVE-2026-116309, CVE-2026-116319 (return_next()), CVE-2026-116320 (array/hash conversion), CVE-2026-116326 (tied-object sigjmp_buf), and CVE-2026-116323 (pltcl reentrant result conversion), all scored 8.8.
• Full-Text Search Heap Overflows: CVE-2026-116315 (tsvector_delete()) and CVE-2026-116317 (ts_rank_cd()), both scored 8.8.
• Parallel & Execution Engine Memory Errors: CVE-2026-116304 (parallel RECORD typmod use-after-free), CVE-2026-116328 (generation memory context integer wraparound), CVE-2026-120139 (tuple-size integer wraparound), CVE-2026-116332 (portal setup use-after-free), CVE-2026-120143 (transition-table cursor use-after-free), and CVE-2026-120150 (expanded-record domain-check use-after-free), all scored 8.8.

3. Client Tools, Replication, and Row-Level Security (RLS) Bypasses

Updating only the server daemon leaves administrative workflows exposed if client binaries remain unpatched:

• Client Tool Injection & Execution: CVE-2026-116314 (pg_restore missing non-plain archive validation, CVSS 8.8), CVE-2026-116318 (pg_dump not-null constraint name SQL injection, CVSS 8.8), CVE-2026-116330 (pg_dump tar restore.sql fails to block psql command injection, CVSS 8.8), CVE-2026-116325 (reindexdb index name quoting SQL injection, CVSS 8.0), and CVE-2026-116313 (vacuumdb --missing-stats-only, CVSS 7.2).
• Logical Replication & Foreign Data Wrappers: CVE-2026-120145 allows logical replication to write to subscriber system catalogs (CVSS 8.8), CVE-2026-120149 hits FDW batch-insert mismatches (CVSS 8.8), and CVE-2026-14661 allows dblink and subscriptions to append to arbitrary files (CVSS 8.1).
• Row-Level Security & View Boundaries: CVE-2026-16237 (auto-updatable view WHERE bypass via INSERT ... ON CONFLICT, CVSS 5.4), CVE-2026-116311 (DROP OWNED removing restrictive RLS policies from non-owned tables, CVSS 5.4), CVE-2026-120154 (INSERT ... ON CONFLICT reading rows despite RLS, CVSS 4.3), and CVE-2026-116303 (foreign key and JSON conversions bypassing EXECUTE privilege on cast functions, CVSS 3.1).

---

Evidence: PostgreSQL 14 EOL Risk and Data-Integrity Fixes

Why PostgreSQL 14 Cannot Remain Unmanaged

Version 14.25 closes out the PostgreSQL 14 branch. According to Safeguard.sh's EOL analysis, PostgreSQL 14 received 36 CVE fixes across its three earlier 2026 minor updates alone (4 in 14.21 on February 12, 8 in 14.23 on May 14, and 24 in 14.24 on August 13)—before the 52 CVEs disclosed on November 12. Remaining on 14.25 means any future vulnerability discovered in shared PostgreSQL core subsystems will remain permanently unpatched in community builds.

For cloud-hosted deployments, Safeguard.sh notes that Amazon RDS maintains standard support for PostgreSQL 14 until February 28, 2027 (transitioning to paid Extended Support thereafter), though older minor versions (14.18 and 14.19) already exited RDS standard support on October 31, 2026.

Silent Data-Corruption & Backup Bugs Resolved

Beyond CVEs, PGDG highlighted several critical correctness bugs in the 140+ bug-fix batch:

• Standby Snapshot Export/Import: Running parallel pg_dump against a standby server could corrupt both the dump output and the standby server's data.
• GIN and pg_trgm GiST Index Corruption: Multiple fixes address index corruption causing queries to miss matching rows or return unrelated rows.
• REINDEX CONCURRENTLY on TOAST Tables: Later index updates could be missed, triggering missing chunk number errors during reads.
• Lengthless bpchar B-Tree Deduplication: B-tree index deduplication is now disabled for columns declared as bpchar without a length (char(n) is unaffected), preventing wrong results on index-only scans.
• Incremental & Base Backups: Fixes prevent corrupt incremental backups, torn pg_control copies, and truncated postgresql.auto.conf files during concurrent replacements.
• Partitioned NOT NULL NO INHERIT Constraints: Disallowed in all cases, including CREATE TABLE ... LIKE, preventing partitions from silently storing NULL values.

---

Hardening Playbook: Patching, Repair Queries, and PG 14 Migration

Execute the following defensive sequence across all database clusters. Do not treat binary installation as the final step.

Step 1: Inventory All Server and Client Binaries

Audit every primary, standby, bastion, and CI/CD runner to capture exact engine and client versions. Ensure client tools (pg_dump, pg_restore, reindexdb, vacuumdb) are upgraded alongside the server:

-- Run on every PostgreSQL instance to verify current build
SELECT version(), current_setting('server_version_num')::int AS version_num;

    # Verify local client binary versions match the patched server branch
pg_dump --version
pg_restore --version
reindexdb --version
vacuumdb --version

Step 2: Apply Cumulative Minor Updates and Verify Extensions

Stop the PostgreSQL service cleanly, update the server and contrib/extension packages from your OS or PGDG repository (updating server and extension packages together to prevent ABI mismatches), and restart.

    # Example Debian/Ubuntu PGDG minor update workflow (adjust version as needed)
sudo systemctl stop postgresql
sudo apt-get update && sudo apt-get install --only-upgrade postgresql-18 postgresql-client-18
sudo systemctl start postgresql

Step 3: Run Post-Update Integrity Audit Queries

Run the following read-only diagnostic queries (derived directly from the PGDG Updating guidelines) to identify objects requiring repair:

-- 1. Detect invalid NOT NULL NO INHERIT constraints on partitioned tables
SELECT conrelid::regclass AS table_name,
       conname AS constraint_name
FROM pg_constraint
WHERE contype = 'n'
  AND connoinherit
  AND conrelid IN (SELECT oid FROM pg_class WHERE relkind = 'p');

-- 2. Locate GIN indexes and pg_trgm GiST indexes (gist_trgm_ops) for reindexing
SELECT n.nspname AS schema_name,
       t.relname AS table_name,
       i.relname AS index_name,
       am.amname AS access_method
FROM pg_index ix
JOIN pg_class i ON i.oid = ix.indexrelid
JOIN pg_class t ON t.oid = ix.indrelid
JOIN pg_namespace n ON n.oid = t.relnamespace
JOIN pg_am am ON am.oid = i.relam
WHERE am.amname IN ('gin', 'gist')
  AND n.nspname NOT IN ('pg_catalog', 'information_schema');

-- 3. Locate B-tree indexes on lengthless bpchar columns (atttypmod = -1)
SELECT n.nspname AS schema_name,
       c.relname AS table_name,
       a.attname AS column_name,
       i.relname AS index_name
FROM pg_index ix
JOIN pg_class i ON i.oid = ix.indexrelid
JOIN pg_class c ON c.oid = ix.indrelid
JOIN pg_namespace n ON n.oid = c.relnamespace
JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = ANY(ix.indkey)
JOIN pg_type ty ON ty.oid = a.atttypid
JOIN pg_am am ON am.oid = i.relam
WHERE am.amname = 'btree'
  AND ty.typname = 'bpchar'
  AND a.atttypmod = -1
  AND n.nspname NOT IN ('pg_catalog', 'information_schema');

Step 4: Execute Targeted Reindexing and Constraint Repairs

For any affected objects surfaced in Step 3:

• GIN / pg_trgm GiST / bpchar B-tree Indexes: Run REINDEX INDEX CONCURRENTLY your_index_name; (or REINDEX TABLE your_table_name; if encountering missing chunk number TOAST errors).
• Partitioned Constraints: Drop unwanted constraints via ALTER TABLE tbl DROP CONSTRAINT conname;, or enforce inheritance via ALTER TABLE tbl ALTER CONSTRAINT conname INHERIT; (which will fail safely if any partition contains NULL values).
• Incremental Backups: Take a fresh full base backup immediately after patching and rebase all subsequent incremental backups on that clean full snapshot.

Step 5: Restrict Object Creation and Harden pg_hba.conf

Because 32 CVSS 8.8 flaws require authenticated object-creation or procedural-language execution privileges, audit role permissions immediately:

• Revoke unnecessary CREATE privileges on public schemas and restrict PL/Perl / PL/Tcl / dblink usage to trusted administrative roles.
• Enforce scram-sha-256 authentication and least-privilege CIDR rules in pg_hba.conf.

Step 6: Plan PostgreSQL 14 Migration and Rollback Readiness

If running PostgreSQL 14.25, schedule a major-version upgrade directly to PostgreSQL 17 or 18 (avoiding 15, which reaches EOL in November 2027).

• Pre-Check: Run pg_upgrade --check against a cloned staging volume first.
• PostgreSQL 19 RC 2 Testing Note: If testing 19 RC 2 ahead of the November 19 GA, drop or redefine any expression indexes, generated columns, or partition keys using JSON_ARRAY() or JSON_OBJECT() over arrays, composite types, or range types, as RC 2 reverts support for those constructs.
• Rollback Note: Minor binary updates can be rolled back by reinstalling the previous minor package version, provided no post-update catalog changes were executed; major pg_upgrade migrations require preserving the pre-upgrade data directory snapshot or logical replication fallback until post-cutover verification passes.

---

Frequently Asked Questions

1. Does applying PostgreSQL 18.7, 17.12, 16.16, 15.20, or 14.25 require pg_upgrade?

No. All five releases are cumulative minor updates. Administrators can stop the PostgreSQL server, update the server and client binaries, and restart the cluster without running pg_upgrade or dumping and reloading data. However, clusters that skipped earlier minor releases should check older release notes for any cumulative post-update steps.

2. Are the 52 PostgreSQL vulnerabilities remotely exploitable without authentication?

No unauthenticated remote network exploits are indicated in the advisory for the CVSS 8.8 batch. Most of the 32 CVSS 8.8 flaws require an authenticated database session with privileges to create objects, alter column types, run PL/Perl or PL/Tcl functions, or invoke text-search and replication paths. However, any application with SQL injection or overly permissive service accounts can bridge that gap.

3. Why do I need to update pg_dump, pg_restore, and reindexdb alongside the server?

Several high-severity vulnerabilities reside in the client utilities themselves: CVE-2026-116314 (CVSS 8.8 in pg_restore), CVE-2026-116318 and CVE-2026-116330 (CVSS 8.8 in pg_dump), CVE-2026-116325 (CVSS 8.0 in reindexdb), and CVE-2026-116313 (CVSS 7.2 in vacuumdb). If you run backups or maintenance against databases where untrusted users can create or name objects, unpatched client binaries remain vulnerable.

4. What happens if my production database stays on PostgreSQL 14.25 after November 12, 2026?

Existing PostgreSQL 14.25 instances will continue operating normally, but they will receive zero upstream security patches or bug fixes going forward. Any newly disclosed CVEs after November 12, 2026, will remain unpatched in community builds, creating compliance and security exposure. Teams should migrate to PostgreSQL 17 or 18 (or verify cloud vendor extended-support timelines such as Amazon RDS's February 28, 2027 standard-support cutoff).

5. Which indexes and backups require manual repair after updating?

PGDG advises reindexing suspected corrupted GIN indexes, any pg_trgm GiST indexes using gist_trgm_ops, any B-tree indexes on lengthless bpchar columns, and any tables throwing missing chunk number errors. Additionally, teams using incremental backups should take a new full backup after patching and use it as the baseline for future incrementals.

6. When is PostgreSQL 19 General Availability (GA) scheduled?

PostgreSQL 19 RC 2 shipped on November 12, 2026, incorporating all applicable security and bug fixes from this cycle. Unless a critical blocker requires an additional release candidate, PostgreSQL 19 GA is scheduled for November 19, 2026.

---

Sources

• PostgreSQL Global Development Group: PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 Released! — Published November 12, 2026.
• PostgreSQL Documentation: Release 18.7 — Published November 12, 2026.
• Help Net Security: PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 — Published November 13, 2026.
• Brandefense: PostgreSQL November 2026 Release: 52 Security Fixes and Update Checks — Published November 13, 2026.
• Safeguard.sh: PostgreSQL 14 End of Life on 12 November 2026 — Published October 19, 2026.