CVE-2026-14673

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14663)

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14664)

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14666)

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14668)

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14669)

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14670)

Type confusion in PostgreSQL module…

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14663)

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14664)

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14666)

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14668)

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14669)

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14670)

Type confusion in PostgreSQL module…

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14663)

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14664)

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14666)

Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14668)

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14669)

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14670)

Type confusion in PostgreSQL module…

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

• SECURITY UPDATE: Out-of-bounds read in pg_dump on long protrftypes. dumpFunc() parsed pg_proc.protrftypes into a fixed FUNC_MAX_ARGS array that is not zero-terminated when the server reports exactly FUNC_MAX_ARGS entries, so the TRANSFORM loop read past the buffer; a function with more entries made pg_dump abort. Any role that can create functions in a language with a transform could thus break or corrupt dumps.
  • debian/patches/CVE-2026-19385.patch: make parseOidArray() allocate the array itself (exact count, or input-sized and zero-terminated), add parseIntArray() for pg_index.indkey, and use them in getAggregates(), getFuncs(), getIndexes() and dumpFunc(); add a function with a transform to the object_address regression test (upstream 57aa21f691; 8.0 servers keep a zero-terminated indkey).
  • CVE-2026-19385
• SECURITY UPDATE: Code execution as table owner via amcheck. bt_index_check() and bt_index_parent_check() switch to the table owner but keep the caller's search_path, so a grantee could make a SQL-language btree operator class comparison function resolve an unqualified name to a function of their own, run as the owner.
  • debian/patches/CVE-2026-14673.patch: set search_path to "pg_catalog, pg_temp" inside the amcheck sandbox, with an operator class regression test (upstream 39d792040c).
  • CVE-2026-14673

• CVE-2026-14663: pgcrypto: propagate cipher initialization errors and add decrypt-only recovery for ciphertexts previously emitted with disabled ciphers
• CVE-2026-14666: invalidate role-dependent cached plans after role membership and role attribute changes
• CVE-2026-14673: amcheck: clear search_path while evaluating index expressions as the table owner
• CVE-2026-14678: pg_trgm: stop treating cached BITVECP signatures as varlena values in GiST picksplit
• CVE-2026-18024: ascii(): validate truncated multibyte input before reading continuation bytes
• CVE-2026-6464: psql: discard inline COPY FROM STDIN data after statement failures instead of executing it as commands
• CVE-2026-6470: enforce USAGE privilege checks on types referenced by ranges, stored expressions, and ALTER TABLE OF

• CVE-2026-14673: run contrib/amcheck's index expressions and predicates with search_path set to "pg_catalog, pg_temp"

psql COPY FROM STDIN early failure processes data lines as psql commands. (CVE-2026-6464) ALTER TABLE ALTER TYPE resets extended statistics ownership. (CVE-2026-6469) Fails to check type USAGE privilege. (CVE-2026-6470) Logical decoding can dlopen arbitrary file. (CVE-2026-6471) tsvector and tsquery undersize allocations, via integer wraparound. (CVE-2026-14662) pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext. (CVE-2026-14663) Regexp heap buffer overflow executes arbitrary code. (CVE-2026-14664) Row security caching disregards role modifications. (CVE-2026-14666) ctid type confusion in selectivity estimator discloses derivative of arbitrary read. (CVE-2026-14668) to_char heap buffer overflow executes arbitrary code. (CVE-2026-14669) plperl tied object heap buffer overflow executes arbitrary code. (CVE-2026-14670) refint plan cache type confusion executes arbitrary code. (CVE-2026-14671) Observable response discrepancy with non-default scram_iterations provides user existence oracle. (CVE-2026-14672) amcheck does not clear untrusted search path. (CVE-2026-14673) pg_stat_statements heap buffer overflow executes arbitrary code. (CVE-2026-14676) 32-bit pltcl and plperl undersize allocations, via integer wraparound. (CVE-2026-14677) pg_trgm picksplit reads past end of buffer. (CVE-2026-14678) Stack buffer overflow in argument match writes 0x0 and 0x1 to server memory. (CVE-2026-14679) Type confusion via "internal" arguments. (CVE-2026-14680) Improper enforcement of GSSAPI encryption when coupled with SSL. (CVE-2026-14681) Expression deparse allows SQL injection via EXTRACT argument. (CVE-2026-15741) fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound. (CVE-2026-15742) Type confusion in pg_restore_attribute_stats() executes arbitrary code. (CVE-2026-16238) Type confusion in cursor CLOSE + DECLARE executes arbitrary code. (CVE-2026-16239) ECPG integer underflow can crash the client. (CVE-2026-16241) ascii() function reads past end of buffer. (CVE-2026-18024) psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client. (CVE-2026-18408) pg_dump heap buffer overflow executes arbitrary code. (CVE-2026-19385)

These are all security issues fixed in the postgresql14-14.24-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql15-15.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the postgresql16-16.15-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libecpg6-18.6-1.1 package on the GA media of openSUSE Tumbleweed.

This update for postgresql14 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql14:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 14.24:
  • https://www.postgresql.org/docs/14/release-14-24.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql15 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql15:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 15.19:
  • https://www.postgresql.org/docs/15/release-15-19.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql16 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql16:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 16.15:
  • https://www.postgresql.org/docs/16/release-16-15.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql18 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 18.6:
  • https://www.postgresql.org/docs/18/release-18-6.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql18 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 18.6:
  • https://www.postgresql.org/docs/18/release-18-6.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql14 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql14:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 14.24:
  • https://www.postgresql.org/docs/14/release-14-24.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql15 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql15:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 15.19:
  • https://www.postgresql.org/docs/15/release-15-19.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql16 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via "internal" arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql16:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 16.15:
  • https://www.postgresql.org/docs/16/release-16-15.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql14 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql14:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 14.24:
  • https://www.postgresql.org/docs/14/release-14-24.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql16 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql16:

• Let llvmjit-devel require the llc and clang binaries to fix build of extensions on SLE-16 and newer.
• Use LLVM 15 on SLE-15 up to SP5 and LLVM 17 on SP6 and SP7.
• Update to version 16.15:
  • https://www.postgresql.org/docs/16/release-16-15.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql15 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql15:

• Update to version 15.19:
  • https://www.postgresql.org/docs/15/release-15-19.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql14 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql14:

• Update to version 14.24:
  • https://www.postgresql.org/docs/14/release-14-24.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql18 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

• Update to version 18.6:
  • https://www.postgresql.org/docs/18/release-18-6.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql16 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql16:

• Update to version 16.15:
  • https://www.postgresql.org/docs/16/release-16-15.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql14 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql14:

• Update to version 14.24:
  • https://www.postgresql.org/docs/14/release-14-24.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql16 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql16:

• Update to version 16.15:
  • https://www.postgresql.org/docs/16/release-16-15.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql18 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

• Update to version 18.6:
  • https://www.postgresql.org/docs/18/release-18-6.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql18 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14672: observable response discrepancy with non-default scram_iterations provides user existence oracle (bsc#1275062).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14676: pg_stat_statements heap buffer overflow executes arbitrary code (bsc#1275060).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-14681: improper enforcement of GSSAPI encryption when coupled with SSL (bsc#1275055).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16238: type confusion in pg_restore_attribute_stats() executes arbitrary code (bsc#1275052).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql18:

• Update to version 18.6:
  • https://www.postgresql.org/docs/18/release-18-6.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql15 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql15:

• Update to version 15.19:
  • https://www.postgresql.org/docs/15/release-15-19.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

This update for postgresql15 fixes the following issues:

• CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands (bsc#1275046).
• CVE-2026-6469: ALTER TABLE ALTER TYPE resets extended statistics ownership (bsc#1275044).
• CVE-2026-6470: failure to check type USAGE privilege (bsc#1275043).
• CVE-2026-6471: logical decoding can dlopen arbitrary file (bsc#1275042).
• CVE-2026-14662: tsvector and tsquery undersize allocations, via integer wraparound (bsc#1275001).
• CVE-2026-14663: pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (bsc#1275002).
• CVE-2026-14664: regexp heap buffer overflow executes arbitrary code (bsc#1275068).
• CVE-2026-14666: row security caching disregards role modifications (bsc#1275067).
• CVE-2026-14668: ctid type confusion in selectivity estimator discloses derivative of arbitrary read (bsc#1275066).
• CVE-2026-14669: to_char heap buffer overflow executes arbitrary code (bsc#1275065).
• CVE-2026-14670: plperl tied object heap buffer overflow executes arbitrary code (bsc#1275064).
• CVE-2026-14671: refint plan cache type confusion executes arbitrary code (bsc#1275063).
• CVE-2026-14673: amcheck does not clear untrusted search path (bsc#1275061).
• CVE-2026-14677: 32-bit pltcl and plperl undersize allocations, via integer wraparound (bsc#1275059).
• CVE-2026-14678: pg_trgm picksplit reads past end of buffer (bsc#1275058).
• CVE-2026-14679: stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (bsc#1275057).
• CVE-2026-14680: type confusion via 'internal' arguments (bsc#1275056).
• CVE-2026-15741: expression deparse allows SQL injection via EXTRACT argument (bsc#1275054).
• CVE-2026-15742: fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (bsc#1275053).
• CVE-2026-16239: type confusion in cursor CLOSE + DECLARE executes arbitrary code (bsc#1275051).
• CVE-2026-16241: ECPG integer underflow can crash the client (bsc#1275050).
• CVE-2026-18024: ascii() function reads past end of buffer (bsc#1275049).
• CVE-2026-18408: psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client (bsc#1275048).
• CVE-2026-19385: pg_dump heap buffer overflow executes arbitrary code (bsc#1275047).

Changes for postgresql15:

• Update to version 15.19:
  • https://www.postgresql.org/docs/15/release-15-19.html
  • https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. (CVE-2026-6464)

It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER TABLE ALTER TYPE operations. An attacker could possibly use this issue to obtain sensitive information or gain unintended privileges. (CVE-2026-6469)

It was discovered that PostgreSQL failed to check the USAGE privilege on types. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-6470)

It was discovered that PostgreSQL logical decoding could load arbitrary shared libraries. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-6471)

It was discovered that PostgreSQL had integer wraparound issues in tsvector and tsquery allocations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14662)

It was discovered that PostgreSQL pgcrypto silently used cleartext when OpenSSL-disabled ciphers were requested. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14663)

It was discovered that PostgreSQL had a heap buffer overflow in regular expression processing. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14664)

It was discovered that PostgreSQL row security policies were not properly invalidated when roles were modified. An attacker could possibly use this issue to bypass intended row security restrictions. (CVE-2026-14666)

It was discovered that PostgreSQL had a type confusion issue in the selectivity estimator involving ctid. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14668)

It was discovered that PostgreSQL had a heap buffer overflow in the to_char function. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14669)

It was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl tied object handling. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14670)

It was discovered that PostgreSQL had a type confusion issue in the referential integrity plan cache. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14671)

It was discovered that PostgreSQL had an observable response discrepancy when non-default scram_iterations were used. A remote attacker could possibly use this issue to enumerate valid usernames. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-14672)

It was discovered that PostgreSQL amcheck did not clear untrusted search paths. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14673)

It was discovered that PostgreSQL had a heap buffer overflow in pg_stat_statements. An authenticated user could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. (CVE-2026-14676)

It was discovered that PostgreSQL had integer wraparound issues in PL/Tcl and PL/Perl allocations on 32-bit systems. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14677)

It was discovered that PostgreSQL pg_trgm read past the end of a buffer during picksplit operations. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14678)

It was discovered that PostgreSQL had a stack buffer overflow in argument matching. An authenticated user could possibly use this issue to corrupt server memory. (CVE-2026-14679)

It was discovered that PostgreSQL had a type confusion issue when functions used internal arguments. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14680)

It was discovered that PostgreSQL did not properly enforce GSSAPI encryption when used…