Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

PostgreSQL patches 52 flaws, including authenticated code execution

4 sources · 4 articlesFirst reported Updated ()1
What's new

November 13: The Hacker News reports Mehmet Ince’s writeup crashes 18.6 and leaks addresses without the final RCE SQL, and names CVE-2026-116322 as an unauthenticated restart flaw in PostgreSQL 18.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

PostgreSQL 14.25 through 18.7 fix 52 vulnerabilities, including authenticated code execution; no attacks are known.

The PostgreSQL Global Development Group released 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, plus 19 RC 2, fixing 52 security vulnerabilities and more than 140 other bugs. Thirty-two flaws score CVSS 8.8. CVE-2026-6460, also 8.8, is a type-confusion bug that can let a user who creates objects run code as the database operating-system user; earlier versions in those branches are affected. The project and CISA report no known attacks. Version 14.25 is the final PostgreSQL 14 release. Some fixes require reindexing and a new full backup, and full protection can require rebuilding C extensions.

Key facts
  • Fixed releases: 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2.
  • CVE-2026-6460 needs object-creation rights; do not set composite_type_mismatch to disable checks.
  • CVE-2026-116322 can let an unauthenticated client restart PostgreSQL 18.
  • A crafted archive can make pg_restore run code as its user.
  • Suspect GIN, gist_trgm_ops GiST, and some bpchar indexes need REINDEX.
  • PostgreSQL 19 is scheduled for November 19; RC 2 drops some JSON expression indexes.
Analyze CVE-2026-6460 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Nov 12, 2026PostgreSQL ships security releases fixing 52 vulnerabilities. · Help Net Security
  2. Nov 19, 2026PostgreSQL 19 release is scheduled. · Help Net Security

What each outlet adds

beyond the shared facts
  • Help Net SecurityCVSS 3.1 cast bypass, pg_dump injection, reindex and backup steps.
  • The Hacker NewsCVE-2026-6460 and CVE-2026-116322 details, CISA, Ince writeup.
CVEs
CVE-2026-6460CVE-2026-116322CVE-2026-14676
Vendors
PostgreSQL Global Development GroupPostgreSQL
Products
PostgreSQLpg_restorepg_dumppsqlreindexdbpg_stat_statements
Organizations
CISARed HatAWSMicrosoftGoogleZero Day Initiative

Coverage

oldest first · one row per article · UTC
  1. · 1d ago oss-securityFirst report

    PostgreSQL 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2 fix 52 flaws

    The oss-security note only points to the PostgreSQL announcement and does not name the individual vulnerabilities.

  2. · 1d ago Help Net Security

    PostgreSQL November update fixes 52 flaws and ends version 14 support

    Thirty-two of the 52 flaws are scored CVSS 8.8, and 14.25 is the final PostgreSQL 14 release.

  3. · 1d ago ZDI Published Advisories

    PostgreSQL pg_stat_statements heap overflow allows authenticated RCE (CVE-2026-14676)

    ZDI rates the authenticated heap overflow CVSS 8.8 and lists no affected or fixed versions.

  4. · 20h ago The Hacker News

    PostgreSQL patches 52 flaws, including authenticated RCE

    CVE-2026-6460, CVSS 8.8, needs object-creation rights; full protection also requires rebuilding C extensions.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-6460
+1 related CVE
CVE-2026-116322
Type confusion RCE in PostgreSQL for object creators
8.8
group max
<1%PoC
CVE-2026-14676
Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via…
8.8<1%