PostgreSQL Ships Coordinated Security Release Fixing 11 CVEs Across Five Supported Versions
PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 landed May 14, fixing 11 security flaws and over 60 bugs, with four CVEs rated 8.8.
Overview
The PostgreSQL Global Development Group released PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 on May 14, 2026, a coordinated update that fixes 11 security vulnerabilities and over 60 bugs reported across all five supported major versions, according to the project’s release announcement. Independent coverage from Linux Compatible and Warp2Search likewise dated the release to May 14 and described eleven patched vulnerabilities ranging, in Warp2Search’s words, from “memory corruption flaws to SQL injection holes.”
The batch is a routine quarterly-style minor release rather than an emergency out-of-cycle patch, but the severity distribution is notable: four of the eleven CVEs carry a CVSS v3 base score of 8.8, the highest in this set, per the PostgreSQL security information page.
What We Know
The release covers every supported version
The update spans PostgreSQL 14, 15, 16, 17, and 18, the announcement states. Eight of the eleven CVEs affect all five of those versions; the remaining three are narrower, with CVE-2026-6476 affecting only versions 18 and 17, CVE-2026-6638 affecting 18, 17, and 16, and CVE-2026-6575 affecting only version 18, according to the security information page.
The four highest-rated flaws
Four CVEs share the top CVSS v3 base score of 8.8, per the security information page:
- CVE-2026-6473 addresses integer overflows in memory-allocation calculations. The PostgreSQL 18.4 release notes explain that “various places were incautious about the possibility of integer overflow in calculations of how much memory to allocate,” producing a too-small buffer that the caller would then write past the end of. The notes add that this “would at least trigger server crashes, and probably could be exploited for arbitrary code execution,” with the hazard in many cases limited to 32-bit builds.
- CVE-2026-6637 fixes SQL injection and buffer overruns in the
contrib/spiexample module. The release notes describe itscheck_foreign_key()function as “insufficiently careful about quoting key values” while also using fixed-length buffers to construct queries. - CVE-2026-6477 marks the libpq function
PQfn()as unsafe. Because the function is not passed the size of its output buffer for a non-integral result type, “a malicious server could therefore overwrite client memory,” the release notes say. The project deemed the issue unfixable without an API change and deprecated the function. - CVE-2026-6475 prevents path traversal in the
pg_basebackupandpg_rewindbackup tools, which the release notes say “failed to validate output file paths read from their input, so that a malicious source could overwrite any file writable by these applications.”
The remaining seven
The other vulnerabilities span denial-of-service, information-disclosure, and privilege-check categories. CVE-2026-6479, rated 7.5, fixes unbounded recursion in startup-packet processing that, the release notes explain, let a malicious client “crash the connected backend by alternating rejected SSL and GSS encryption requests indefinitely.” The project credited Calif.io “in collaboration with Claude and Anthropic Research” for that report.
CVE-2026-6476, rated 7.2, properly quotes subscription names in pg_createsubscriber to close an SQL injection path, and CVE-2026-6638, rated 3.7, applies the same quoting discipline to logical replication origin checks, the release notes show. CVE-2026-6478, rated 6.5, switches authentication code to timing-safe string comparison; CVE-2026-6474, rated 4.3, guards timeofday() and pg_strftime() against malicious time zone names that could disclose server memory; CVE-2026-6575, rated 4.3, hardens restoration of most-common-value statistics against inputs that could crash the planner; and CVE-2026-6472, rated 5.4, adds a missing CREATE privilege check when a multirange type is placed in a schema, per the same release notes. The privilege-check fix was reported by Jelte Fennema-Nio, the release notes state.
Bug fixes beyond the CVEs
The more-than-60 non-security bug fixes include several planner and correctness changes. The announcement highlights a fix for “queries that could return incorrect results when using a nondeterministic collation over a unique index,” a fix for “loss of deferrability of foreign-key triggers,” and an improvement to “the planner’s ability to apply partition pruning to more cases.” It also notes that MERGE will now “report a serialization failure” when it hits a concurrently-updated tuple under repeatable-read or serializable isolation, and that restores of incremental backups no longer bloat.
Upgrading
The releases are cumulative minor updates. The announcement states that “users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply stop PostgreSQL and update its binaries.” The 18.4 release notes confirm that “a dump/restore is not required for those running 18.X.” Linux Compatible summarized the same procedure as “stopping the postgres service, replacing the binaries with the new files, and restarting the daemon”.
What We Don’t Know
The project has not reported any of these vulnerabilities as exploited in the wild, and the announcement does not say whether proof-of-concept code exists for the higher-severity flaws. Several of the SQL injection issues — including the pg_createsubscriber and replication-origin cases — depend on attacker-controlled input reaching specific tooling, and the release notes themselves call the pg_createsubscriber scenario “perhaps unlikely.” The practical exploitability of CVE-2026-6473 outside 32-bit builds is also not fully characterized in the published materials.
Analysis
The headline number for operators planning their patch cycle is the EOL date for the oldest supported branch. The announcement warns that “PostgreSQL 14 will stop receiving fixes on November 12, 2026,” and advises production users still on that branch to plan an upgrade — guidance echoed by Linux Compatible and Warp2Search, both of which noted that official support ends in November 2026. With 14.23 likely among the final maintenance releases for that branch, the May update is a natural prompt for the migration work many PostgreSQL 14 deployments have deferred.