Cloud service vulnerability, severity high

PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25 fix 52 vulnerabilities, including code execution flaws

Published November 12, 2026

The PostgreSQL project released updates on November 12 that fix 52 security vulnerabilities, 32 of them CVSS 8.8. Most of the high-scoring bugs are memory errors or type confusion in PL/Perl, PL/Tcl, text search, parallel query, logical replication, dblink and statistics import. The pg_dump and reindexdb client tools also had injection and quoting flaws. PostgreSQL 14.25 is the final PostgreSQL 14 release.

What's affected

• postgresqlevery version
• postgres>=18.0 <18.7; >=17.0 <17.12; >=16.0 <16.16; >=15.0 <15.20; >=14.0 <14.25

What to do

1. Update PostgreSQL servers to 18.7, 17.12, 16.16, 15.20 or 14.25.
2. Update client tools such as pg_dump and reindexdb along with the server, especially where other users can create and name database objects.
3. Reindex suspect GIN indexes, pg_trgm GiST indexes using gist_trgm_ops, and B-tree indexes on bpchar columns without a length, as described in the release notes.
4. If you use incremental backups, take a new full backup and base later incrementals on it.
5. Plan a move off PostgreSQL 14, which gets no further security or bug fixes.

Check whether you were affected

To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it. The check is free and needs no account:

/pharon:check-incident postgresql-security-release-2026-11

References

• https://www.helpnetsecurity.com/2026/11/13/postgresql-security-update-november-2026/

Notice postgresql-security-release-2026-11, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.