# PostgreSQL fixes 52 security flaws across all supported versions, ends PostgreSQL 14 support

> **Key takeaway:** This synchronized update patches 52 CVEs—many rated CVSS 8.8 for arbitrary code execution—and marks the final release of PostgreSQL 14, which reaches end-of-life.

**Published:** 2026-11-12T16:02:22.185678+00:00 
**Source:** PostgreSQL Official News 
**Category:** databases-storage 
**Canonical URL:** https://fosswire.org/news/postgresql-fixes-52-security-flaws-across-all-supported-vers.html 

## Summary
The PostgreSQL Global Development Group released maintenance updates for all supported versions—18.7, 17.12, 16.16, 15.20, and 14.25—alongside PostgreSQL 19 RC 2. The release closes 52 security vulnerabilities and resolves over 140 bugs reported in recent months. Multiple CVEs carry CVSS v3.1 scores of 8.8, spanning use-after-free conditions in plperl and pltcl, type confusion in ALTER operations and aggregate functions, heap buffer overflows in tsvector functions, and SQL injection vectors in pg_dump and reindexdb. The update also marks the end-of-life for PostgreSQL 14, which will no longer receive security or bug fixes.

Administrators should review the "Updating" section of the release notes, as several fixes require post-update steps beyond simple package replacement. The breadth of high-severity memory safety and privilege escalation issues makes this a critical patch cycle for production deployments, particularly those using extensions, logical replication, or custom types.

## Security fixes and operational changes in this release cycle
- **Memory safety in procedural languages:** Multiple CVEs address use-after-free and type confusion bugs in plperl (CVE-2026-116307, CVE-2026-116309, CVE-2026-116319, CVE-2026-116320, CVE-2026-116326) and pltcl (CVE-2026-116323), where reentrant execution paths or conversion routines could trigger arbitrary code execution.
- **Type system and catalog vulnerabilities:** Several high-severity flaws involve type confusion in core operations, including ALTER ... SET DATA TYPE (CVE-2026-6460), output parameters (CVE-2026-18447), composite-type field assignment (CVE-2026-116306), dropped columns (CVE-2026-120142), and materialized set-returning functions (CVE-2026-120141), all rated CVSS 8.8.
- **Buffer overflows and integer wraparounds:** Heap buffer overflows in tsvector_delete() and ts_rank_cd() (CVE-2026-116315, CVE-2026-116317), generation memory context integer wraparound (CVE-2026-116328), and tuple-size wraparound (CVE-2026-120139) allow arbitrary code execution through crafted inputs or operations.
- **Privilege escalation and access control bypasses:** CVE-2026-116313 allows database owners to execute code as the vacuumdb user via --missing-stats-only; CVE-2026-116316 permits security-restricted operations to create types in pg_temp; CVE-2026-120145 enables logical replication to write subscriber system catalogs.
- **SQL injection and validation gaps:** pg_dump constraint names (CVE-2026-116318), pg_restore archive validation (CVE-2026-116314), reindexdb quoting (CVE-2026-116325), and pg_dump tar restore.sql (CVE-2026-116330) all expose injection or format-string attack surfaces in backup and maintenance tooling.

## Why it matters
This release represents one of the largest security patch cycles in PostgreSQL's recent history, with memory safety flaws spanning the core type system, procedural language runtimes, and backup utilities that are central to most operational workflows. Linux distributions and managed database services will need to expedite packaging and deployment, while the EOL of PostgreSQL 14 forces organizations still on that branch to plan major version upgrades to maintain security support. The concentration of use-after-free and type confusion bugs in plperl specifically affects deployments relying on Perl extensions for database logic, a pattern common in legacy enterprise and scientific computing environments.