PostgreSQL Ships Coordinated Release Fixing 28 CVEs Across Five Versions, Debuts 19 Beta 3

Overview

The PostgreSQL Global Development Group released updates to every supported version of the open-source database on August 13, 2026 — versions 18.6, 17.11, 16.15, 15.19, and 14.24 — alongside the third beta of the upcoming PostgreSQL 19, according to the project’s release announcement. The coordinated batch “fixes 28 security vulnerabilities and over 110 bugs reported over the last several months,” the announcement states, a considerably larger set than the 11-CVE release the project shipped in May.

The release also comes with an unusual wrinkle: it “skips PostgreSQL 18 versions from PostgreSQL 18.4 to 18.6,” the announcement notes, because “18.5 was not shipped due to a regression.” Version 18.6 is therefore the first 18.x release since 18.4 to reach users.

What We Know

Several of the highest-severity flaws touch backup and restore tooling

Of the 28 vulnerabilities patched, a number carry the top CVSS v3.1 base score in this batch, 8.8, according to PostgreSQL’s security information page. Independent scoring from the National Vulnerability Database confirms the same 8.8 rating for several of them and adds technical detail the project’s own pages summarize more briefly.

CVE-2026-19385 is a “[h]eap buffer overflow in PostgreSQL pg_dump of long function transform lists” that “allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list,” per NVD’s description.

CVE-2026-18408 involves “[u]ntrusted data inclusion in pg_dump” that “allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion,” NVD’s writeup explains, adding that the flaw “also impacts pg_dumpall and pg_restore when generating plain-format dumps.”

A third high-severity flaw, CVE-2026-15741, describes “SQL injection in PostgreSQL EXTRACT() deparse” that “allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition,” with attacks affecting “expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any similar usage in non-core tools,” according to NVD.

A fourth, CVE-2026-14664, is a “[h]eap buffer overflow in PostgreSQL regexp” that “allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation,” per NVD.

Three fixes require manual follow-up after updating

The announcement flags three issues that “may require you to take extra steps after updating,” the release notes state: a parallel GIN index-build bug that can leave stale row-count statistics, requiring administrators to check affected indexes and re-run ANALYZE; a btree_gist extension fix for how NaN floating-point values and bit-string columns are indexed, requiring a REINDEX of affected indexes; and an ltree fix for indexes covering values with very large numbers of labels, which likewise calls for a REINDEX.

PostgreSQL 19 Beta 3 narrows toward general availability

Alongside the security patches, the project shipped the third beta of PostgreSQL 19, which previously entered testing in June with Beta 1. Beta 3 is chiefly a fix-up release: it reverts the GROUP BY ALL feature, applies “[s]everal fixes for the new FOR PORTION OF temporal table syntax,” and includes “[s]everal fixes for the new logical replication sequence synchronization feature, including a race involving REFRESH SEQUENCES,” the announcement details.

Other Beta 3 fixes include an “unexpected logical decoding status change” error that could occur when logical decoding is activated concurrently, issues around ownership changes for subscriptions, wrong query results from postgres_fdw when pushing down an array comparison involving an implicit type coercion, a crash during foreign-key checks involving a nullable UNIQUE constraint, a pg_plan_advice parsing bug with underscores in numeric literals, and a missing FORMAT clause when deparsing JSON_ARRAY(query), according to the release notes.

Time zone data and end-of-life notice

The release also updates bundled time zone data to tzdata release 2026c. Under the new data, Alberta’s America/Edmonton zone “will be on year-round UTC-06 (effectively, permanent DST) beginning in November 2026,” and Morocco’s Africa/Casablanca zone “will move to permanent UTC+00, without daylight saving transitions, on September 20, 2026,” the announcement says.

Separately, the project reiterated that “PostgreSQL 14 will stop receiving fixes on November 12, 2026,” according to the announcement, giving users on that branch roughly three months to upgrade before it loses support.

What We Don’t Know

The announcement does not give a firm release date for PostgreSQL 19’s general availability beyond the beta cycle already underway; Beta 1’s release notes had pointed to a target of around September or October 2026, and Beta 3 does not update that timeline. The project’s pages also do not specify how many of the 28 CVEs have been exploited in the wild, if any.