PostgreSQL patches 52 security flaws across all supported versions as PostgreSQL 14 reaches end of life

Every supported branch gets patched

The PostgreSQL Global Development Group has released updates for every supported version of the database — 18.7, 17.12, 16.16, 15.20 and 14.25 — alongside the second release candidate of PostgreSQL 19. According to the group's announcement, dated 12 November 2026, the round closes 52 security vulnerabilities and more than 140 bugs reported over recent months. The project also warns that several fixes require manual follow-up steps after upgrading, spelled out in the release's "Updating" section.

What the security fixes cover

The list is dominated by memory-safety and type-confusion flaws that the project says can end in arbitrary code execution, and a large share of the CVEs carry a CVSS v3.1 score of 8.8. Among the high scorers: type confusion triggered by ALTER ... SET DATA TYPE (CVE-2026-6460), type confusion in output parameters (CVE-2026-18447), a use-after-free in parallel RECORD typmod handling (CVE-2026-116304), pg_restore lacking validation of non-plain archives (CVE-2026-116314), a heap buffer overflow in tsvector_delete() (CVE-2026-116315), and logical replication able to write into system catalogs on subscribers (CVE-2026-120145).

The PL/Perl interpreter takes the most individual hits, with use-after-free and type-confusion fixes spread across CVE-2026-116307, CVE-2026-116309, CVE-2026-116319, CVE-2026-116320 and CVE-2026-116326, and PL/Tcl gets its own use-after-free fix (CVE-2026-116323).

Other entries stand out because of the everyday operations they touch. dblink connections and logical subscriptions could be used to append data to arbitrary files on a server (CVE-2026-14661, scored 8.1); the restore.sql script inside pg_dump's tar-format output did not prevent psql command injection (CVE-2026-116330); names of NOT NULL constraints opened SQL injection in pg_dump (CVE-2026-116318); a database owner could run code under the vacuumdb user's identity via vacuumdb --missing-stats-only (CVE-2026-116313, scored 7.2); and extension script handling receives two injection-adjacent fixes (CVE-2026-6467 and CVE-2026-120153, both 7.2).

Quieter logic bugs round out the set: INSERT ... ON CONFLICT could read or modify rows that an auto-updatable view's WHERE condition or a row-security policy should have hidden (CVE-2026-16237 and CVE-2026-120154), and DROP OWNED could remove restrictive row-security policies from tables not owned by the executing role (CVE-2026-116311).

PostgreSQL 14 reaches end of life

Version 14.25 is the final release PostgreSQL 14 will ever receive. The group states that the version is now end-of-life and will get no further security or bug fixes, and it advises operators still running 14 in production to plan a move to a supported version.

Fixes that need more than a restart

Several non-security fixes address corruption scenarios in which installing the patch does not repair existing damage:

• Snapshots taken on a standby server and later exported or imported could produce wrong results, and when hit through a parallel pg_dump running against a standby, could corrupt both the dump output and the standby's own data.
• GIN indexes could become corrupted such that queries missed rows or returned unrelated ones; the project recommends reindexing any index you suspect is affected.
• pg_trgm GiST indexes could corrupt in a way that made searches miss matching rows; these require a reindex after updating.
• If REINDEX CONCURRENTLY rebuilt an index on a TOAST table, later updates to that index could be lost, surfacing as errors about missing chunk numbers; affected indexes need another reindex.
• NOT NULL NO INHERIT constraints on partitioned tables are now rejected in all cases, including CREATE TABLE ... LIKE. Previously a partition could end up holding NULL values where it should not, and the announcement explains how to locate and repair affected constraints.
• B-tree index deduplication is switched off for bpchar columns declared without a length, where it could produce wrong results from index-only scans.

The project notes that the listed bugs affect PostgreSQL 18, and that many of them also apply to the other supported branches.

Why it matters

Fifty-two CVEs across every supported branch — many rated 8.8 and several reachable through routine operations like logical replication, pg_dump and pg_restore — make this far more than a routine minor-version bump. The PostgreSQL 14 end-of-life notice is just as consequential: deployments that stay on 14 after this release receive no future security patches, turning today's update into a hard deadline for a major-version upgrade. And because several of the fixes call for post-update reindexing or constraint repair, simply restarting on the new minor versions may leave corrupted indexes in place. With PostgreSQL 19's second release candidate now circulating, teams facing both the patch round and the 14 retirement may find it sensible to sequence the two efforts together.