Postgresql Release Notes

Upgrading to PostgreSQL 19 Beta 2

To upgrade to PostgreSQL 19 Beta 2 from an earlier version of PostgreSQL, you will need to use a strategy similar to upgrading between major versions of PostgreSQL (e.g. pg_upgrade or pg_dump/pg_restore). For more information, please visit the documentation section on upgrading.

Changes Since Beta 1

Fixes and changes in PostgreSQL 19 Beta 2 include:

• Fix a regression in vacuumdb --analyze-in-stages for partitioned tables.
• Fix servicefile to show correct file after fallback to system file.
• Fix tuple deformation optimization for virtual generated columns.
• Allow pg_createsubscriber to accept duplicate publication names.
• Fix REPACK worker not being cleaned up on a FATAL exit.
• Several fixes for the new FOR PORTION OF temporal table syntax.
• Fix race condition when logical decoding activation is concurrently interrupted.
• Disallow negative values for max_retention_duration.
• Fix md5_password_warnings for role and database settings.
• Several fixes for the new SQL/PGQ property graph feature.
• Fix autovacuum's multixact-age score calculation, which could become infinite.
• Revert non-text output formats for pg_dumpall.
• Fix locking for ALTER DOMAIN ... VALIDATE CONSTRAINT.
• Fix how postgres_fdw handles imported foreign-table statistics.

Please see the release notes for a complete list of new and changed features:
https://www.postgresql.org/docs/19/release-19.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 19. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:
https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the second beta release of version 19. The PostgreSQL Project will release additional betas as required for testing, followed by one or more release candidates, until the final release around September/October 2026. For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 19 Beta Release Notes
• PostgreSQL 19 Open Issues
• Submit a Bug
• Donate

Original source

The PostgreSQL Global Development Group announces that the first beta release of PostgreSQL 19 is now available for download. This release contains PostgreSQL 19 feature previews ahead of general availability, though some details of the release can change during the beta period.

You can find information about all of the PostgreSQL 19 features and changes in the release notes:
https://www.postgresql.org/docs/19/release-19.html

In the spirit of the open source PostgreSQL community, we strongly encourage you to test the new features of PostgreSQL 19 on your systems to help us eliminate bugs and other issues. While we do not advise you to run beta versions in production environments, we encourage you to find ways to run your typical application workloads against this beta release.

Your testing and feedback help the community ensure that PostgreSQL 19 upholds our standards of delivering a stable, reliable release of the world's most advanced open source relational database. Please read more about our beta testing process and how you can contribute:
https://www.postgresql.org/developer/beta/

PostgreSQL 19 Feature Highlights

Below are some of the feature highlights that are planned for PostgreSQL 19. This list is not exhaustive; for the full list of planned features, please see the release notes.

Performance

PostgreSQL 19 builds on the asynchronous I/O subsystem introduced in PostgreSQL 18. In this release, io_method=worker now automatically scales the number of I/O workers based on the new io_min_workers and io_max_workers settings.

This release also introduces the pg_plan_advice extension, which lets users stabilize and control planner decisions, along with pg_stash_advice to apply advice automatically using query identifiers.

This release brings improvements to vacuum and maintenance operations. Autovacuum can now use parallel workers, which can be configured with the new autovacuum_max_parallel_workers setting, and a new autovacuum scoring system helps prioritize tables to vacuum. PostgreSQL 19 further enhances vacuum with a new strategy that can automatically reduce future vacuuming work by marking pages as visible while they're being queried. Additionally, this release adds the new REPACK command and its nonblocking CONCURRENTLY option, which allow tables to be rebuilt with less operational overhead.

PostgreSQL 19 shows up to 2x better performance on inserts when foreign key checks are present. Additionally, this release improves several areas of the query planner and executor, including new anti-join optimizations, broader use of incremental sorts, eager aggregation that speeds up row processing, faster reads from storage during parallel sequential scans, and simplification of IS DISTINCT FROM and IS NOT DISTINCT FROM to plain <> and = operators when the inputs are not nullable. There are also improvements for LISTEN/NOTIFY scalability that impact multi-channel workloads.

Developer Experience

PostgreSQL 19 introduces support for SQL/PGQ, letting users execute property graph queries using SQL standard syntax. This release also expands temporal query capabilities with UPDATE and DELETE support for the FOR PORTION OF clause, complementing the temporal constraint support added in PostgreSQL 18. This release also adds ALTER TABLE ... MERGE PARTITIONS and ALTER TABLE ... SPLIT PARTITIONS to make it easier to reorganize partitioned tables in place. There is now also support for returning rows that conflict during an upsert operation using INSERT ... ON CONFLICT DO SELECT ... RETURNING.

PostgreSQL 19 introduces the new GROUP BY ALL syntax, making it easy to add all non-aggregate and non-window output columns as part of the grouping. This release extends string processing capabilities in jsonpath with the addition of lower(), upper(), initcap(), replace(), split_part(), and the trim() family of functions.

PostgreSQL 19 makes it easier to adopt "read-your-writes" query patterns when working with replicas using the new WAIT FOR LSN command. This lets a session wait until changes up to a specific log position (LSN) have been replayed on the replica before executing a SELECT query.

PostgreSQL 19 also adds new SQL functions to retrieve the DDL statements needed to recreate roles, tablespaces, and databases, simplifying scripting and migration tasks. Additionally, the random() function now works with date and timestamp types, and PL/Python now supports event triggers.

Security Features

PostgreSQL 19 adds server-side support for Server Name Indication (SNI) through a new pg_hosts.conf file, allowing a single PostgreSQL server to present different TLS certificates based on the hostname requested by the client. There is also a new password_expiration_warning_threshold setting (defaulting to 7 days) to warn users in advance of upcoming password expirations.

Further to the ongoing deprecation efforts of md5 authentication, this release issues a warning to the client after a successful md5 authentication. This is controllable via the new md5_password_warnings setting.

Monitoring and Observability

PostgreSQL 19 introduces the pg_stat_lock view, which reports per-lock-type statistics, and pg_stat_recovery which provides detailed visibility into the state of recovery operations. A stats_reset column is now available across many statistics views to show when counters were last cleared. The pg_stat_progress_vacuum and pg_stat_progress_analyze views now include a started_by column that reports the initiator of the operation, and pg_stat_progress_vacuum also has a mode column that reports how vacuum is operating.

This release also allows log_min_messages levels to be specified per process type, giving operators finer control over what each part of the system logs. Additionally, WAL full page write byte counts are now reported in VACUUM and ANALYZE log output, helping identify maintenance operations that generate large amounts of WAL. Additionally, EXPLAIN ANALYZE now supports surfacing asynchronous I/O (AIO) statistics through its IO option, providing better visibility into how queries are using the AIO subsystem.

Logical Replication and Query Federation

In PostgreSQL 19, logical replication now replicates sequence values, simplifying tasks like online upgrades. Additionally, the new CREATE PUBLICATION ... EXCEPT syntax allows you to publish all tables in a database except for a specified set, while CREATE SUBSCRIPTION ... SERVER allows subscriptions to be defined using a foreign server, simplifying credential management.

PostgreSQL 19 makes it possible to enable logical replication without restarting a server. Logical replication can now be enabled on demand even when wal_level is set to replica, and the new read-only effective_wal_level parameter reports the WAL level currently in effect. This reduces the need to commit upfront to a higher WAL level for clusters that may only occasionally need it, and avoids disrupting an active workload.

The PostgreSQL foreign data wrapper, postgres_fdw, used for query federation, includes several performance improvements, including pushing down array operations to the remote server, and retrieving and using statistics from foreign tables to support better local query planning.

Other Highlights

The PostgreSQL 19 beta period includes a temporary "grease mode" to try to find protocol compatibility problems in the wider ecosystem. This wiki page contains information on how the campaign works:
https://wiki.postgresql.org/wiki/Grease

PostgreSQL 19 allows data checksums to be enabled or disabled online, without requiring a cluster restart or reinitialization.

There are several notable changes to be aware of in PostgreSQL 19. Just-in-time compilation (JIT) is now disabled by default, and the default_toast_compression setting now defaults to lz4, providing better default compression and decompression performance. Support for RADIUS authentication is now removed. Additionally, the vacuumdb --analyze-only command by default analyzes partitioned tables.

Additional Features

Many other new features and improvements have been added to PostgreSQL 19. Many of these may also be helpful for your use cases. Please see the release notes for a complete list of new and changed features:
https://www.postgresql.org/docs/19/release-19.html

Testing for Bugs & Compatibility

The stability of each PostgreSQL release greatly depends on you, the community, to test the upcoming version with your workloads and testing tools to find bugs and regressions before the general availability of PostgreSQL 19. As this is a Beta, minor changes to database behaviors, feature details, and APIs are still possible. Your feedback and testing will help determine the final tweaks on the new features, so please test in the near future. The quality of user testing helps determine when we can make a final release.

A list of open issues is publicly available in the PostgreSQL wiki. You can report bugs using this form on the PostgreSQL website:
https://www.postgresql.org/account/submitbug/

Beta Schedule

This is the first beta release of version 19. The PostgreSQL Project will release additional betas as required for testing, followed by one or more release candidates, until the final release around September/October 2026. For further information please see the Beta Testing page.

Links

• Download
• Beta Testing Information
• PostgreSQL 19 Beta Release Notes
• PostgreSQL 19 Open Issues
• Submit a Bug
• Donate

Original source

This release contains a variety of fixes from 18.3. For information about new features in major release 18, see Section E.5.

A dump/restore is not required for those running 18.X. However, if you are upgrading from a version earlier than 18.2, see Section E.3.

Fixes

• Prevent unbounded recursion while processing startup packets (Michael Paquier) §
  A malicious client could crash the connected backend by alternating rejected SSL and GSS encryption requests indefinitely.
  The PostgreSQL Project thanks Calif.io (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-6479)

• Fix assorted integer overflows in memory-allocation calculations (Tom Lane, Nathan Bossart, Heikki Linnakangas) § § § § § § § § §
  Various places were incautious about the possibility of integer overflow in calculations of how much memory to allocate. Overflow would lead to allocating a too-small buffer which the caller would then write past the end of. This would at least trigger server crashes, and probably could be exploited for arbitrary code execution. In many but by no means all cases, the hazard exists only in 32-bit builds.
  The PostgreSQL Project thanks Xint Code, Bruce Dang, Sven Klemm, and Pavel Kohout for reporting these problems. (CVE-2026-6473)

• Properly quote subscription names in pg_createsubscriber (Nathan Bossart) §
  The given subscription name was inserted into SQL commands without quoting, so that SQL injection could be achieved in the (perhaps unlikely) case that the subscription name comes from an untrusted source.
  The PostgreSQL Project thanks Yu Kunpeng for reporting this problem. (CVE-2026-6476)

• Properly quote object names in logical replication origin checks (Pavel Kohout) §
  ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and relation names into SQL commands without quoting them, allowing execution of arbitrary SQL on the publisher.
  The PostgreSQL Project thanks Pavel Kohout for reporting this problem. (CVE-2026-6638)

• Reject over-length options in ts_headline() (Michael Paquier) §
  The StartSel, StopSel, and FragmentDelimiter strings must not exceed 32Kb in length, but this was not checked for. An over-length value would typically crash the server.
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473)

• Detect faulty input when restoring attribute MCV statistics (Michael Paquier) §
  The statistics restore functions were insufficiently careful about validating most-common-value statistics, and would accept values that could crash the planner later on.
  The PostgreSQL Project thanks Jeroen Gui for reporting this problem. (CVE-2026-6575)

• Guard against malicious time zone names in timeofday() and pg_strftime() (Tom Lane) § §
  A crafted time zone setting could pass % sequences to snprintf(), potentially causing crashes or disclosure of server memory. Another path to similar results was to overflow the limited-size output buffer used by pg_strftime().
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6474)

• When creating a multirange type, ensure the user has CREATE privilege on the schema specified for the multirange type (Jelte Fennema-Nio) §
  The multirange type can be put into a different schema than its parent range type, but we neglected to apply the required privilege check when doing so.
  The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2026-6472)

• Use timing-safe string comparisons in authentication code (Michael Paquier) §
  Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking passwords, hashes, etc. It is not known whether the data dependency of those functions is usefully exploitable in any of these places, but in the interests of safety, replace them.
  The PostgreSQL Project thanks Joe Conway for reporting this problem. (CVE-2026-6478)

• Mark PQfn() as unsafe, and avoid using it within libpq (Nathan Bossart) §
  For a non-integral result type, PQfn() is not passed the size of the output buffer, so it cannot check that the data returned by the server will fit. A malicious server could therefore overwrite client memory. This is unfixable without an API change, so mark the function as deprecated. Internally to libpq, use a variant version that can apply the missing check.
  The PostgreSQL Project thanks Yu Kunpeng and Martin Heistermann for reporting this problem. (CVE-2026-6477)

• Prevent path traversal in pg_basebackup and pg_rewind (Michael Paquier) §
  These applications failed to validate output file paths read from their input, so that a malicious source could overwrite any file writable by these applications. Constrain where data can be written by rejecting paths that are absolute or contain parent-directory references.
  The PostgreSQL Project thanks XlabAI Team of Tencent Xuanwu Lab and Valery Gubanov for reporting this problem. (CVE-2026-6475)

• Guard against field overflow within contrib/intarray's query_int type and contrib/ltree's ltxtquery type (Tom Lane) § §
  Parsing of these query structures did not check for overflow of 16-bit fields, so that construction of an invalid query tree was possible. This can crash the server when executing the query.
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473)

• Guard against overly long values of contrib/ltree's lquery type (Michael Paquier) §
  Values with more than 64K items caused internal overflows, potentially resulting in stack smashes or wrong answers.
  The PostgreSQL Project thanks Vergissmeinnicht, A1ex, and Jihe Wang for reporting this problem. (CVE-2026-6473)

• Prevent SQL injection and buffer overruns in contrib/spi (Nathan Bossart) §
  check_foreign_key() was insufficiently careful about quoting key values, and also used fixed-length buffers for constructing queries. While this module is only meant as example code, it still shouldn't contain such dangerous errors.
  The PostgreSQL Project thanks Nikolay Samokhvalov for reporting this problem. (CVE-2026-6637)

• Check for nondeterministic collations before assuming that an equality condition on a collatable type implies uniqueness (Richard Guo) § § § § §
  Numerous planner optimizations assume that, for example, at most one table row can satisfy WHERE x = 'abc' if there is a unique index on x. However this conclusion is unsafe in general if the index and the WHERE clause have different collations attached. It is safe when both collations are deterministic, because that property essentially requires that equality of two strings means bitwise equality. But nondeterministic collations don't act that way, so that optimizing on the assumption of unique matches can give wrong query answers if either the WHERE clause or the index has a nondeterministic collation.

• Fix incomplete removal of relation references in RestrictInfo structs during join removal (Tom Lane) §
  This oversight has been shown to result in planner failures such as unexpected “FULL JOIN is only supported with merge-joinable or hash-joinable join conditions” errors. It may also have caused failure to consider valid plans in other cases.

• Improve planner's matching of partition key columns to sub-query outputs (Richard Guo) §
  Strip no-op PlaceHolderVars from operands before comparing them to partition keys. This change enables partition pruning to succeed in some cases where it previously failed to recognize that a partition need not be scanned.

• Fix self-join removal to handle join clauses that are bare boolean columns, e.g. ON t1.boolcol (Andrei Lepikhov, Tender Wang, Alexander Korotkov) §
  Previously such a case led to a “no relation entry for relid N” error.

• Fix UPDATE/DELETE ... WHERE CURRENT OF to work on tables with virtual generated columns (Satyanarayana Narlapuram, Dean Rasheed) §

• Fix expansion of virtual generated columns in EXCLUDED column references in INSERT ... ON CONFLICT (Satyanarayana Narlapuram, Dean Rasheed) §

• Fix incorrect handling of NEW generated columns in rule actions and rule qualifications (Richard Guo, Dean Rasheed) §
  Previously, such column references would produce NULL in INSERT cases, or be equivalent to the OLD value in UPDATE cases.

• Fix spurious “indexes on virtual generated columns are not supported” errors (Robert Haas) §
  Creation of an expression index could sometimes incorrectly report this error.

• Fix spurious “generated columns are not supported in COPY FROM WHERE conditions” errors (Tom Lane) §
  Use of a system column in a COPY FROM WHERE condition could sometimes incorrectly report this error.

• Correctly report a serialization failure when MERGE encounters a concurrently-updated tuple in repeatable-read or serializable mode (Tender Wang) §
  Previously, such cases behaved the same as in lower isolation levels.

• Fix CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the source table has dropped column(s) (Julien Tachoires) §
  In such cases, extended statistics objects could be copied incorrectly, or the command could give an incorrect error.

• Allow ALTER INDEX ... ATTACH PARTITION to mark the parent index valid if appropriate (Sami Imseih) §
  There are edge cases in which a partitioned index might remain marked as invalid even when all its leaf indexes are valid. This change provides a mechanism whereby a user can correct such a situation without resorting to manual catalog updates.

• Fix ALTER TABLE ... SET NOT NULL to invoke object-access hook functions only after completing the catalog change (Artur Zakirov) §

• Fix ALTER FOREIGN DATA WRAPPER to not drop the wrapper object's dependency on its handler function (Jeff Davis) §

• Fix loss of deferrability of foreign-key triggers (Yasuo Honda) §
  Previously, a foreign key defined as DEFERRABLE INITIALLY DEFERRED would behave as NOT DEFERRABLE after being set to NOT ENFORCED status and then back to ENFORCED.
  If you have a foreign key with this problem, it can be repaired (after installing this update) by again setting it to NOT ENFORCED and then back to ENFORCED.

• Fix WITHOUT OVERLAPS to allow domains (Jian He) §
  UNIQUE/PRIMARY KEY ... WITHOUT OVERLAPS requires the no-overlap column to be a range or multirange, but it should allow a domain over such a type too.

• Disallow making a composite type be a member of itself via a multirange (Heikki Linnakangas) §
  We already forbade such cases when the intermediate type is a domain, array, composite type, or range; but multiranges were overlooked.

• Fix datum-image comparisons to be insensitive to sign-extension variations (David Rowley) §
  This fixes some situations that previously led to “could not find memoization table entry” errors or wrong query results.

• Fix incorrect logic for hashed IN / NOT IN with non-strict equality operator (Chengpeng Yan) §
  The previous coding could crash or give wrong answers. All built-in data types have strict equality operators, so that this issue could only arise with an extension data type.

• Truncate overly-long locale-specific numeric symbols in to_char() (Tom Lane) §
  If a locale specified a currency symbol, thousands separator, or decimal or sign symbol more than 8 bytes long, a buffer overrun was possible. No such locales exist in the real world, and it's impractical for an unprivileged attacker to install a malicious locale definition underneath a Postgres server; but for safety's sake check for overlength symbols and truncate if needed.

• Prevent buffer overruns when parsing an affix file for an Ispell dictionary (Tom Lane) § §
  A corrupt or malicious affix file could crash the server. This is not considered a security issue because text search configuration files are presumed trustworthy, but it still seems worth fixing.

• Guard against integer overflow in calculations of frame start and end positions for window aggregates (Richard Guo) §
  Very large user-specified offsets (close to INT64_MAX) could result in errors or incorrect query results.

• Fix array_agg_array_combine() to combine the arrays' null bitmaps correctly (Dmytro Astapov) §
  This mistake resulted in sometimes-incorrect output from parallelized array_agg(anyarray) calculations.

• Retry sync_file_range() if it returns error code EINTR (DaeMyung Kang) §

• Fix incorrect behavior of pg_stat_reset_single_table_counters() on a shared catalog (Chao Li) §
  Such cases had a side-effect of resetting the current database's stat_reset_timestamp, which was unintended.

• Update activity statistics when a parallel apply worker is idle (Zhijie Hou) §
  Previously, statistics from a recently-completed transaction might go unreported for long intervals, particularly if the workload is light.

• Fix “no relation entry for relid 0” failure while estimating array lengths in set operations (Tender Wang) §

• Fix buffer overread when pglz_decompress() receives corrupt input (Andrew Dunstan) §
  It was possible to read a few bytes past the end of the input, which in very unlucky cases might cause a crash.

• Fix incremental JSON parser's handling of numeric tokens that cross input buffer boundaries (Andrew Dunstan) §
  It was possible to accept an incorrectly-formatted number, leading to failures later.

• Prevent bloating relation visibility maps during restore of an incremental backup (Robert Haas) §
  Restore could append many blocks of zeroes to a visibility map, due to incorrect computation of the expected file length. This does not result in data corruption, but it could waste a substantial amount of disk space.

• Use C collation, not the database's default collation, in catalog cache lookups on text columns (Jeff Davis) §
  This avoids failures in edge cases such as physical replication startup, where there is no identified database so that a default collation cannot be determined.

• Prevent stuck slotsync worker processes from blocking promotion of a standby server (Nisha Moond, Ajin Cherian) § § §
  A worker process that was vainly waiting for a response from the primary would delay promotion for an unreasonable amount of time.

• Fix excessive log output from idle slotsync worker processes (Zhijie Hou) §

• Ensure that tuplestore data structures are internally consistent even after an error (Tom Lane) §
  The code was previously careless about this, which is fine most of the time but is problematic for the tuplestore backing a WITH HOLD cursor. In v15 and before this leads to easily-reproducible crashes; later branches are not known to be vulnerable, but it seems best to preserve consistency in all.

• Make the pg_aios system view's pid column show NULL not 0 when an entry has no owning process (ChangAo Chen) §

• Fix premature NULL lag reporting in pg_stat_replication (Shinya Kato) §
  The lag columns frequently read as NULL even while replication activity was happening.

• Fix under-allocation of shared memory used for parallel btree index scans (Siddharth Kothari) §
  In edge cases this could result in a server crash.

• Avoid rare flush failure when working with non-WAL-logged GiST indexes (Tomas Vondra) §
  A non-logged GiST index could nonetheless sometimes produce “xlog flush request n/nnnn is not satisfied” errors, due to incorrect selection of a “fake LSN” to represent an insertion point.

• Fix underestimate of required size of DSA page maps for odd-size segments (Paul Bunn) §
  This miscalculation led to out-of-bounds accesses and hence server crashes.

• Fix indexing of oldest-multixact arrays in shared memory (Yura Sokolov) § §
  This mistake could cause a prepared-but-not-yet-committed transaction's row locks to appear invisible to other sessions, or other visibility issues for the results of such a transaction. With a very small max_connections setting, memory stomps were also possible.

• Fix array overrun when too many EXPLAIN extension options are installed (Joel Jacobson) §

• Fix possible server crash when processing extended statistics on expressions of extension data types (Michael Paquier) §
  NULL pointer dereferences were possible if the data type's typanalyze function does not compute any useful statistics. No in-core typanalyze function behaves that way, but extensions could.

• Correctly display join alias Vars that are used in GROUP BY (Tom Lane) §
  In views containing queries like SELECT ... t1 LEFT JOIN t2 USING (x) GROUP BY x, the GROUP BY clause could be displayed incorrectly by deparsing, leading to dump/restore failures. Failures occurred only if t1.x and t2.x were not of identical data types and t1.x was the side that required an implicit coercion.

• Fix minor memory leaks in ICU-based string processing (Jeff Davis) §

• If the startup process fails, properly shut down other child processes before exiting the postmaster (Ayush Tiwari) §
  The handling of this situation relied on a long-obsolete assumption that no other postmaster children exist while the startup process is running, so that immediate postmaster exit is acceptable. Orphaned children would eventually notice the postmaster's death and exit on their own, but a cleaner shutdown procedure is desirable.

• Fix race condition between WAL replay of checkpoints and multixact ID creations (Heikki Linnakangas) §
  A standby server following WAL from a primary of an older minor version could get into a crash-and-restart loop complaining about “could not access status of transaction”.

• Prevent indefinite wait in shutdown of a walsender process (Anthonin Bonnefoy) § §
  At shutdown of a cluster that is publishing logical replication data, the walsender waits for all pending WAL to be written out. But it did not correctly request that to happen, so that in some cases this could become an indefinite wait.

• Ensure that changes to tables' free space maps are persisted during recovery (Alexey Makhmutov) §
  Previously, while WAL replay did update the free space map while replaying operations that should change it, the map page buffer did not get marked dirty if checksums are enabled, so that the changes might never get written out. On a standby server, over time this would result in a map wildly at variance with the table's actual contents. While the map is only used as a hint, this condition could cause significant performance degradation for some period of time after the standby server is promoted to be active, until most of the map has been repaired by updates.

• Fix crashes in some ecpg functions when called without any established connection (Shruthi Gowda) §

• Harden tar-file parsing logic against archives it can't handle (Tom Lane) §
  The tar-file reading code used in pg_basebackup and pg_verifybackup failed to verify that the input is a tar file at all, let alone that it fits into the subset of valid tar files that we can handle. This isn't a problem for the normal scenario where the input file was generated by PostgreSQL code, but it can be an issue if the input has been generated by some other tar program.

• Fix assorted bugs in backup decompression and tar-parsing code (Andrew Dunstan, Tom Lane, Chao Li) § § §
  The decompression and tar-file reading code used in pg_basebackup and pg_verifybackup mishandled tar-file padding data, could corrupt LZ4-compressed data in edge cases, failed to check for some unusual error conditions, failed to exit after compression/decompression errors (leading to cascading error reports), and leaked memory.

• In pg_dump, preserve NO INHERIT property of NOT NULL constraints (Jian He) §
  Some cases missed printing the NO INHERIT clause.

• In pg_dumpall, don't skip role GRANTs with dangling grantor OIDs (Tom Lane) §
  Instead, handle such cases by emitting GRANT without any GRANTED BY clause, as we did before v16. This avoids losing the grant in foreseeable cases, since pre-v16 servers didn't prevent dropping the grantor role. Continue to emit a warning about the missing grantor, but only if the source server is v16 or later.

• In pg_upgrade, take care to use the correct protocol version when connecting to older source servers (Jacob Champion) §
  This could be problematic when attempting to upgrade from a pre-2018 server.

• In contrib/basic_archive, allow the archive directory to be missing at startup (Nathan Bossart) §
  Previously, the setting of basic_archive.archive_directory was rejected if it didn't point to an existing directory. This is undesirable because archiving will be stuck indefinitely, even if the directory appears later.

• Fix contrib/ltree to cope when case-folding changes a string's byte length (Jeff Davis) § §
  Previously, lquery patterns specifying case-insensitive matching might fail to match labels they should match.

• Fix mis-structured output from contrib/pg_overexplain's RANGE_TABLE option (Satyanarayana Narlapuram) §
  Some fields were misplaced in JSON, YAML, and XML formats, resulting in structurally invalid output.

• In contrib/pg_stat_statements, don't leak memory if an error occurs while parsing the pgss_query_texts.stat file (Heikki Linnakangas) §

• In contrib/postgres_fdw, avoid crash due to premature cleanup of a failed connection (Etsuro Fujita) §
  If a remote connection fails abort cleanup, we can't use it any longer. But delay closing the connection object until end of transaction, because there might still be references to it within data structures such as open cursors.

• Update time zone data files to tzdata release 2026b (Tom Lane) §
  British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used. Also a historical correction for Moldova: they have followed EU DST transition times since 2022.

Original source

This release contains a variety of fixes from 17.9. For information about new features in major release 17, see Section E.11.

A dump/restore is not required for those running 17.X. However, if you are upgrading from a version earlier than 17.6, see Section E.5.

Fixes and security issues

• Prevent unbounded recursion while processing startup packets (Michael Paquier) § §
  A malicious client could crash the connected backend by alternating rejected SSL and GSS encryption requests indefinitely.
  The PostgreSQL Project thanks Calif.io (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-6479)

• Fix assorted integer overflows in memory-allocation calculations (Tom Lane, Nathan Bossart, Heikki Linnakangas) § § § § § § § § § §
  Various places were incautious about the possibility of integer overflow in calculations of how much memory to allocate. Overflow would lead to allocating a too-small buffer which the caller would then write past the end of. This would at least trigger server crashes, and probably could be exploited for arbitrary code execution. In many but by no means all cases, the hazard exists only in 32-bit builds.
  The PostgreSQL Project thanks Xint Code, Bruce Dang, Sven Klemm, and Pavel Kohout for reporting these problems. (CVE-2026-6473)

• Properly quote subscription names in pg_createsubscriber (Nathan Bossart) §
  The given subscription name was inserted into SQL commands without quoting, so that SQL injection could be achieved in the (perhaps unlikely) case that the subscription name comes from an untrusted source.
  The PostgreSQL Project thanks Yu Kunpeng for reporting this problem. (CVE-2026-6476)

• Properly quote object names in logical replication origin checks (Pavel Kohout) §
  ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and relation names into SQL commands without quoting them, allowing execution of arbitrary SQL on the publisher.
  The PostgreSQL Project thanks Pavel Kohout for reporting this problem. (CVE-2026-6638)

• Reject over-length options in ts_headline() (Michael Paquier) §
  The StartSel, StopSel, and FragmentDelimiter strings must not exceed 32Kb in length, but this was not checked for. An over-length value would typically crash the server.
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473)

• Guard against malicious time zone names in timeofday() and pg_strftime() (Tom Lane) § §
  A crafted time zone setting could pass % sequences to snprintf(), potentially causing crashes or disclosure of server memory. Another path to similar results was to overflow the limited-size output buffer used by pg_strftime().
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6474)

• When creating a multirange type, ensure the user has CREATE privilege on the schema specified for the multirange type (Jelte Fennema-Nio) §
  The multirange type can be put into a different schema than its parent range type, but we neglected to apply the required privilege check when doing so.
  The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2026-6472)

• Use timing-safe string comparisons in authentication code (Michael Paquier) § §
  Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking passwords, hashes, etc. It is not known whether the data dependency of those functions is usefully exploitable in any of these places, but in the interests of safety, replace them.
  The PostgreSQL Project thanks Joe Conway for reporting this problem. (CVE-2026-6478)

• Mark PQfn() as unsafe, and avoid using it within libpq (Nathan Bossart) §
  For a non-integral result type, PQfn() is not passed the size of the output buffer, so it cannot check that the data returned by the server will fit. A malicious server could therefore overwrite client memory. This is unfixable without an API change, so mark the function as deprecated. Internally to libpq, use a variant version that can apply the missing check.
  The PostgreSQL Project thanks Yu Kunpeng and Martin Heistermann for reporting this problem. (CVE-2026-6477)

• Prevent path traversal in pg_basebackup and pg_rewind (Michael Paquier) §
  These applications failed to validate output file paths read from their input, so that a malicious source could overwrite any file writable by these applications. Constrain where data can be written by rejecting paths that are absolute or contain parent-directory references.
  The PostgreSQL Project thanks XlabAI Team of Tencent Xuanwu Lab and Valery Gubanov for reporting this problem. (CVE-2026-6475)

• Guard against field overflow within contrib/intarray's query_int type and contrib/ltree's ltxtquery type (Tom Lane) § §
  Parsing of these query structures did not check for overflow of 16-bit fields, so that construction of an invalid query tree was possible. This can crash the server when executing the query.
  The PostgreSQL Project thanks Xint Code for reporting this problem. (CVE-2026-6473)

• Guard against overly long values of contrib/ltree's lquery type (Michael Paquier) §
  Values with more than 64K items caused internal overflows, potentially resulting in stack smashes or wrong answers.
  The PostgreSQL Project thanks Vergissmeinnicht, A1ex, and Jihe Wang for reporting this problem. (CVE-2026-6473)

• Prevent SQL injection and buffer overruns in contrib/spi (Nathan Bossart) §
  check_foreign_key() was insufficiently careful about quoting key values, and also used fixed-length buffers for constructing queries. While this module is only meant as example code, it still shouldn't contain such dangerous errors.
  The PostgreSQL Project thanks Nikolay Samokhvalov for reporting this problem. (CVE-2026-6637)

• Check for nondeterministic collations before assuming that an equality condition on a collatable type implies uniqueness (Richard Guo) § §
  Numerous planner optimizations assume that, for example, at most one table row can satisfy WHERE x = 'abc' if there is a unique index on x. However this conclusion is unsafe in general if the index and the WHERE clause have different collations attached. It is safe when both collations are deterministic, because that property essentially requires that equality of two strings means bitwise equality. But nondeterministic collations don't act that way, so that optimizing on the assumption of unique matches can give wrong query answers if either the WHERE clause or the index has a nondeterministic collation.

• Fix incomplete removal of relation references in RestrictInfo structs during join removal (Tom Lane) § §
  This oversight has been shown to result in planner failures such as unexpected “FULL JOIN is only supported with merge-joinable or hash-joinable join conditions” errors. It may also have caused failure to consider valid plans in other cases.

• Fix incorrect handling of NEW generated columns in rule actions and rule qualifications (Richard Guo, Dean Rasheed) §
  Previously, such column references would produce NULL in INSERT cases, or be equivalent to the OLD value in UPDATE cases.

• Fix spurious “generated columns are not supported in COPY FROM WHERE conditions” errors (Tom Lane) §
  Use of a system column in a COPY FROM WHERE condition could sometimes incorrectly report this error.

• Correctly report a serialization failure when MERGE encounters a concurrently-updated tuple in repeatable-read or serializable mode (Tender Wang) §
  Previously, such cases behaved the same as in lower isolation levels.

• Fix CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the source table has dropped column(s) (Julien Tachoires) §
  In such cases, extended statistics objects could be copied incorrectly, or the command could give an incorrect error.

• Allow ALTER INDEX ... ATTACH PARTITION to mark the parent index valid if appropriate (Sami Imseih) §
  There are edge cases in which a partitioned index might remain marked as invalid even when all its leaf indexes are valid. This change provides a mechanism whereby a user can correct such a situation without resorting to manual catalog updates.

• Fix ALTER FOREIGN DATA WRAPPER to not drop the wrapper object's dependency on its handler function (Jeff Davis) §

• Disallow making a composite type be a member of itself via a multirange (Heikki Linnakangas) §
  We already forbade such cases when the intermediate type is a domain, array, composite type, or range; but multiranges were overlooked.

• Fix datum-image comparisons to be insensitive to sign-extension variations (David Rowley) §
  This fixes some situations that previously led to “could not find memoization table entry” errors or wrong query results.

• Fix incorrect logic for hashed IN / NOT IN with non-strict equality operator (Chengpeng Yan) §
  The previous coding could crash or give wrong answers. All built-in data types have strict equality operators, so that this issue could only arise with an extension data type.

• Truncate overly-long locale-specific numeric symbols in to_char() (Tom Lane) §
  If a locale specified a currency symbol, thousands separator, or decimal or sign symbol more than 8 bytes long, a buffer overrun was possible. No such locales exist in the real world, and it's impractical for an unprivileged attacker to install a malicious locale definition underneath a Postgres server; but for safety's sake check for overlength symbols and truncate if needed.

• Prevent buffer overruns when parsing an affix file for an Ispell dictionary (Tom Lane) § §
  A corrupt or malicious affix file could crash the server. This is not considered a security issue because text search configuration files are presumed trustworthy, but it still seems worth fixing.

• Guard against integer overflow in calculations of frame start and end positions for window aggregates (Richard Guo) §
  Very large user-specified offsets (close to INT64_MAX) could result in errors or incorrect query results.

• Fix array_agg_array_combine() to combine the arrays' null bitmaps correctly (Dmytro Astapov) §
  This mistake resulted in sometimes-incorrect output from parallelized array_agg(anyarray) calculations.

• Retry sync_file_range() if it returns error code EINTR (DaeMyung Kang) §

• Fix incorrect behavior of pg_stat_reset_single_table_counters() on a shared catalog (Chao Li) §
  Such cases had a side-effect of resetting the current database's stat_reset_timestamp, which was unintended.

• Update activity statistics when a parallel apply worker is idle (Zhijie Hou) §
  Previously, statistics from a recently-completed transaction might go unreported for long intervals, particularly if the workload is light.

• Fix “no relation entry for relid 0” failure while estimating array lengths in set operations (Tender Wang) §

• Fix buffer overread when pglz_decompress() receives corrupt input (Andrew Dunstan) §
  It was possible to read a few bytes past the end of the input, which in very unlucky cases might cause a crash.

• Fix incremental JSON parser's handling of numeric tokens that cross input buffer boundaries (Andrew Dunstan) §
  It was possible to accept an incorrectly-formatted number, leading to failures later.

• Prevent bloating relation visibility maps during restore of an incremental backup (Robert Haas) §
  Restore could append many blocks of zeroes to a visibility map, due to incorrect computation of the expected file length. This does not result in data corruption, but it could waste a substantial amount of disk space.

• Use C collation, not the database's default collation, in catalog cache lookups on text columns (Jeff Davis) §
  This avoids failures in edge cases such as physical replication startup, where there is no identified database so that a default collation cannot be determined.

• Prevent stuck slotsync worker processes from blocking promotion of a standby server (Nisha Moond, Ajin Cherian) § § §
  A worker process that was vainly waiting for a response from the primary would delay promotion for an unreasonable amount of time.

• Fix excessive log output from idle slotsync worker processes (Zhijie Hou) §

• Ensure that tuplestore data structures are internally consistent even after an error (Tom Lane) §
  The code was previously careless about this, which is fine most of the time but is problematic for the tuplestore backing a WITH HOLD cursor. In v15 and before this leads to easily-reproducible crashes; later branches are not known to be vulnerable, but it seems best to preserve consistency in all.

• Fix premature NULL lag reporting in pg_stat_replication (Shinya Kato) §
  The lag columns frequently read as NULL even while replication activity was happening.

• Avoid rare flush failure when working with non-WAL-logged GiST indexes (Tomas Vondra) §
  A non-logged GiST index could nonetheless sometimes produce “xlog flush request n/nnnn is not satisfied” errors, due to incorrect selection of a “fake LSN” to represent an insertion point.

• Fix underestimate of required size of DSA page maps for odd-size segments (Paul Bunn) §
  This miscalculation led to out-of-bounds accesses and hence server crashes.

• Fix indexing of oldest-multixact arrays in shared memory (Yura Sokolov) § §
  This mistake could cause a prepared-but-not-yet-committed transaction's row locks to appear invisible to other sessions, or other visibility issues for the results of such a transaction. With a very small max_connections setting, memory stomps were also possible.

• Fix possible server crash when processing extended statistics on expressions of extension data types (Michael Paquier) §
  NULL pointer dereferences were possible if the data type's typanalyze function does not compute any useful statistics. No in-core typanalyze function behaves that way, but extensions could.

• Fix minor memory leaks in ICU-based string processing (Jeff Davis) §

• If the startup process fails, properly shut down other child processes before exiting the postmaster (Ayush Tiwari) §
  The handling of this situation relied on a long-obsolete assumption that no other postmaster children exist while the startup process is running, so that immediate postmaster exit is acceptable. Orphaned children would eventually notice the postmaster's death and exit on their own, but a cleaner shutdown procedure is desirable.

• Fix race condition between WAL replay of checkpoints and multixact ID creations (Heikki Linnakangas) §
  A standby server following WAL from a primary of an older minor version could get into a crash-and-restart loop complaining about “could not access status of transaction”.

• Prevent indefinite wait in shutdown of a walsender process (Anthonin Bonnefoy) § §
  At shutdown of a cluster that is publishing logical replication data, the walsender waits for all pending WAL to be written out. But it did not correctly request that to happen, so that in some cases this could become an indefinite wait.

• Ensure that changes to tables' free space maps are persisted during recovery (Alexey Makhmutov) §
  Previously, while WAL replay did update the free space map while replaying operations that should change it, the map page buffer did not get marked dirty if checksums are enabled, so that the changes might never get written out. On a standby server, over time this would result in a map wildly at variance with the table's actual contents. While the map is only used as a hint, this condition could cause significant performance degradation for some period of time after the standby server is promoted to be active, until most of the map has been repaired by updates.

• Fix crashes in some ecpg functions when called without any established connection (Shruthi Gowda) §

• Fix assorted bugs in backup decompression and tar-parsing code (Andrew Dunstan, Tom Lane, Chao Li) § § §
  The decompression and tar-file reading code used in pg_basebackup and pg_verifybackup mishandled tar-file padding data, could corrupt LZ4-compressed data in edge cases, failed to check for some unusual error conditions, failed to exit after compression/decompression errors (leading to cascading error reports), and leaked memory.

• In pg_dumpall, don't skip role GRANTs with dangling grantor OIDs (Tom Lane) §
  Instead, handle such cases by emitting GRANT without any GRANTED BY clause, as we did before v16. This avoids losing the grant in foreseeable cases, since pre-v16 servers didn't prevent dropping the grantor role. Continue to emit a warning about the missing grantor, but only if the source server is v16 or later.

• In pg_upgrade, take care to use the correct protocol version when connecting to older source servers (Jacob Champion) §
  This could be problematic when attempting to upgrade from a pre-2018 server.

• In contrib/basic_archive, allow the archive directory to be missing at startup (Nathan Bossart) §
  Previously, the setting of basic_archive.archive_directory was rejected if it didn't point to an existing directory. This is undesirable because archiving will be stuck indefinitely, even if the directory appears later.

• Fix contrib/ltree to cope when case-folding changes a string's byte length (Jeff Davis) §
  Previously, lquery patterns specifying case-insensitive matching might fail to match labels they should match.

• In contrib/pg_stat_statements, don't leak memory if an error occurs while parsing the pgss_query_texts.stat file (Heikki Linnakangas) §

• In contrib/postgres_fdw, avoid crash due to premature cleanup of a failed connection (Etsuro Fujita) §
  If a remote connection fails abort cleanup, we can't use it any longer. But delay closing the connection object until end of transaction, because there might still be references to it within data structures such as open cursors.

• Update time zone data files to tzdata release 2026b (Tom Lane) §
  British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used. Also a historical correction for Moldova: they have followed EU DST transition times since 2022.

Original source

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18, and 14.23.

This release fixes 11 security vulnerabilities and over 60 bugs reported over the last several months.

For the full list of changes, please review the release notes.

PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are running PostgreSQL 14 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our versioning policy for more information.

Security Issues

CVE-2026-6472: PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege

CVSS v3.1 Base Score: 5.4

Supported, Vulnerable Versions: 14 - 18.

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.

CVE-2026-6473: PostgreSQL server undersizes allocations, via integer wraparound

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Integer wraparound in multiple PostgreSQL server features allows an application input provider to cause the server to undersize an allocation and write out-of-bounds. This results in a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Anemone, A1ex, Xint Code, Jihe Wang, Jingzhou Fu, Pavel Kohout, Petr Simecek, www.aisle.com, Bruce Dang of Calif.io, and Sven Klemm for reporting this problem.

CVE-2026-6474: PostgreSQL timeofday() can disclose portions of server memory

CVSS v3.1 Base Score: 4.3

Supported, Vulnerable Versions: 14 - 18.

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Xint Code for reporting this problem.

CVE-2026-6475: PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Valery Gubanov, XlabAI Team of Tencent Xuanwu Lab, Atuin Automated Vulnerability Discovery Engine, Zhanpeng Liu (pkugenuine(at)gmail(dot)com), Guannan Wang (wgnbuaa(at)gmail(dot)com), and Guancheng Li (lgcpku(at)gmail(dot)com) for reporting this problem.

CVE-2026-6476: PostgreSQL pg_createsubscriber allows SQL injection via subscription name

CVSS v3.1 Base Score: 7.2

Supported, Vulnerable Versions: 17 - 18.

SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next runs. Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected. Versions before PostgreSQL 17 are unaffected.

The PostgreSQL project thanks Yu Kunpeng for reporting this problem.

CVE-2026-6477: PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Yu Kunpeng and Martin Heistermann for reporting this problem.

CVE-2026-6478: PostgreSQL discloses MD5-hashed passwords via covert timing channel

CVSS v3.1 Base Score: 6.5

Supported, Vulnerable Versions: 14 - 18.

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Joe Conway for reporting this problem.

CVE-2026-6479: PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

CVSS v3.1 Base Score: 7.5

Supported, Vulnerable Versions: 14 - 18.

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Calif.io in collaboration with Claude and Anthropic Research for reporting this problem.

CVE-2026-6575: PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array

CVSS v3.1 Base Score: 4.3

Supported, Vulnerable Versions: 18.

Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintainer to infer memory values past that array end. Within major version 18, minor versions before PostgreSQL 18.4 are affected. Versions before PostgreSQL 18 are unaffected.

The PostgreSQL project thanks Jeroen Gui for reporting this problem.

CVE-2026-6637: PostgreSQL refint allows stack buffer overflow and SQL injection

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Stack buffer overflow in PostgreSQL module refint allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a refint cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

The PostgreSQL project thanks Nikolay Samokhvalov for reporting this problem.

CVE-2026-6638: PostgreSQL REFRESH PUBLICATION allows SQL injection via table name

CVSS v3.1 Base Score: 3.7

Supported, Vulnerable Versions: 16 - 18.

SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials. The attack takes effect at the next REFRESH PUBLICATION. Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected. Versions before PostgreSQL 16 are unaffected.

The PostgreSQL project thanks Pavel Kohout, Aisle Research for reporting this problem.

Bug Fixes and Improvements

This update fixes over 60 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

• Fix queries that could return incorrect results when using a nondeterministic collation over a unique index.
• Fix loss of deferrability of foreign-key triggers. Previously, a foreign key defined as DEFERRABLE INITIALLY DEFERRED would behave as NOT DEFERRABLE after being set to NOT ENFORCED status and then back to ENFORCED. If you have a foreign key with this problem, after installing this update you can fix it by setting it to NOT ENFORCED and then back to ENFORCED.
• Improve the planner's ability to apply partition pruning to more cases.
• Fix self-join removal to handle join clauses that are only boolean columns, for example, ON t1.boolcol.
• Several fixes around virtual generated columns, including ensuring INSERT ... ON CONFLICT works when EXCLUDED references a virtual generated column.
• Report a serialization failure when MERGE encounters a concurrently-updated tuple in "repeatable read" or "serializable" isolation modes.
• Fix CREATE TABLE ... LIKE ... INCLUDING STATISTICS for cases where the source table had one or more dropped columns.
• Fix WITHOUT OVERLAPS to allow domains.
• Disallow making a composite type be a member of itself via a multirange.
• Fix sometimes-incorrect results when array_agg(anyarray) executes in parallel.
• Prevent bloating during restore of an incremental backup.
• Prevent stuck logical replication slot synchronization worker processes from blocking promotion of a standby server.
• Make the pg_aios system view pid column show NULL instead of 0 when an entry has no owning process.
• Fix cases where pg_stat_replication shows NULL lag even while replication is active.
• Correctly display JOIN alias variables that are used in GROUP BY.
• If the startup process fails, properly shut down other child processes before exiting the postmaster.
• Fix race condition that could cause a standby server following WAL from a primary of an older minor version to get into a crash-and-restart loop.
• Prevent indefinite wait in shutdown of a walsender process when logical replication is actively publishing data.
• Ensure that free space map changes are persisted during recovery. This could have performance ramifications on a standby server after promotion.
• Fix assorted bugs in backup decompression and tar-parsing code used in pg_basebackup and pg_verifybackup.
• Ensure pg_dumpall doesn't skip role grants with dangling grantor OIDs, restoring the behavior before PostgreSQL 16. Emits a warning about missing grantor if the source server is PostgreSQL 16 or later.
• Fix pg_upgrade to use the correct protocol version when connecting to older source servers.
• Fix output in pg_overexplain when using the RANGE_TABLE option.
• Fix postgres_fdw crash due to premature cleanup of a failed connection.

This release also updates time zone data files to tzdata release 2026b, in which British Columbia (America/Vancouver) will be on year-round UTC-07 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be MST from that time forward (though this could change). There is also a historical correction for Moldova, which has used EU DST transition times since 2022.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply stop PostgreSQL and update its binaries.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the [email protected] public mailing list.

Original source

This release contains a small number of fixes from 18.2. For information about new features in major release 18, see Section E.5.

A dump/restore is not required for those running 18.X.

However, if you are upgrading from a version earlier than 18.2, see Section E.3.

Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas)

Erroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like “could not access status of transaction”. A typical scenario in which this could occur is a standby server of the latest minor version consuming WAL from a primary server of an older version.

Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data (Noah Misch)

The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.

Fix oversight in the fix for CVE-2026-2007 (Zsolt Parragi)

If the “bounds” array needed to be expanded, because the input contained more trigrams than the initial guess, generate_trgm_only didn't return the modified array pointer to its caller. That would lead to incorrect output from strict_word_similarity() and related functions, or in rare cases a crash. The faulty code is reached if the input string becomes longer when it's converted to lower case. The only known instances of that occur when an ICU locale is used with certain single-byte encodings.

Fix the volatility marking of json_strip_nulls() and jsonb_strip_nulls() (Andrew Dunstan)

These functions have always been considered immutable, but refactoring in version 18 accidentally marked them stable instead. That prevents their use in index expressions and could cause unnecessary repeat evaluations in queries. This fix corrects the marking in newly-initialized database clusters (including clusters that are pg_upgrade'd to 18.3 or later). However it will not help existing clusters made using 18.0 through 18.2.

If this mistake affects your usage of these functions, the recommended fix for an existing cluster is a manual catalog update. As superuser, perform UPDATE pg_catalog.pg_proc SET provolatile = 'i' WHERE oid IN ('3261','3262'); in each affected database. Update template0 and template1 as well, so that databases made in future will have the fix.

Fix computation of the set of potentially-nulling outer joins for the output of a LATERAL UNION ALL subquery (Richard Guo)

This error could lead to skipping NOT NULL tests in the mistaken belief that they were unnecessary, resulting in wrong query output.

Avoid name collisions between user-written constraints and automatically-named NOT NULL constraints (Laurenz Albe)

As of version 18, NOT NULL constraints have full-fledged pg_constraint entries, and therefore require names. The logic for choosing a name for an unnamed NOT NULL constraint failed to avoid conflicts with user-written constraints elsewhere in the same CREATE TABLE statement.

Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes (Heikki Linnakangas)

Previously these functions returned NULL for auxiliary processes, but that's inconsistent with the pg_stat_activity view.

Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane)

If the variable's value is NULL, a “cache lookup failed for type 0” error resulted.

Fix potential null pointer dereference in contrib/hstore's binary input function (Michael Paquier)

hstore's receive function crashed on input containing duplicate keys. hstore values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be provoked by malicious or corrupted data.

Original source

This release contains a small number of fixes from 17.8. For information about new features in major release 17, see Section E.11.

A dump/restore is not required for those running 17.X.

However, if you are upgrading from a version earlier than 17.6, see Section E.5.

Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas)

Erroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like “could not access status of transaction”. A typical scenario in which this could occur is a standby server of the latest minor version consuming WAL from a primary server of an older version.

Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data (Noah Misch)

The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.

Fix computation of the set of potentially-nulling outer joins for the output of a LATERAL UNION ALL subquery (Richard Guo)

This error could lead to skipping NOT NULL tests in the mistaken belief that they were unnecessary, resulting in wrong query output.

Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes (Heikki Linnakangas)

Previously these functions returned NULL for auxiliary processes, but that's inconsistent with the pg_stat_activity view.

Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane)

If the variable's value is NULL, a “cache lookup failed for type 0” error resulted.

Fix potential null pointer dereference in contrib/hstore's binary input function (Michael Paquier)

hstore's receive function crashed on input containing duplicate keys. hstore values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be provoked by malicious or corrupted data.

Original source

The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17, and 14.22. This is an out-of-cycle release that fixes several regressions reported after the last update release.

For the full list of changes, please review the release notes.

Bug Fixes and Improvements

This update fixes several bugs that were reported since the previous release. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

• Fix issue where a standby would halt and return an error "could not access status of transaction".
• Fix error where the substring() function would raise an error "invalid byte sequence for encoding" on non-ASCII text values if the source of that value is a database column. This was due to a change introduced for the fix to CVE-2026-2006.
• Fix for the strict_word_similarity function in pg_trgm that could lead to incorrect output or crashes. This was due to an oversight in the fix for CVE-2026-2007.
• Fix function volatility for json_strip_nulls() and jsonb_strip_nulls() to be immutable, like previous releases, allowing for them to be used in indexes. If you previously upgraded to PostgreSQL 18.0 through 18.2, see the additional steps in the "Updating" section.
• Fix for NOT NULL tests in LATERAL UNION ALL subquery that could lead to wrong query output.
• Avoid NOT NULL constraints from generating name conflicts with user-written constraints.
• Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes, similar to pg_stat_activity.
• Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function.
• Fix the hstore binary input function to avoid crashes on input with duplicate keys.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

If you previously upgraded to PostgreSQL 18.0, 18.1 or 18.2, you need to execute the following SQL as a PostgreSQL superuser in all of your databases to make the json_strip_nulls() and jsonb_strip_nulls() functions immutable:

UPDATE pg_catalog.pg_proc SET provolatile = 'i' WHERE oid IN ('3261','3262');

You should also execute this command in the template0 and template1 databases so future databases you create in your PostgreSQL cluster have the correct function volatility setting. Please see the documentation on template databases for more information.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the [email protected] public mailing list.

Original source

News from apt.postgresql.org

Changelogs

apt.postgresql.org now has changelog files in a place where apt can retrieve them automatically, for example

apt changelog postgresql-18

will download the file and display it in a pager. Mind that the files are only present yet for packages updated since last week, the rest will follow over time.

Build logs

Likewise, package build logs are now also stored along with the packages in .build.xz files in the pool directory. (There is no automated download tool for them, though.)

Ubuntu releases resolute and plucky

Work on the upcoming Ubuntu 26.04 "resolute" release has started and packages are available on apt.postgresql.org.

The Ubuntu 25.04 "plucky" release has reached its end of life and has been moved to apt-archive.postgresql.org.

Christoph

Original source

The PostgreSQL Global Development Group is planning for an out-of-cycle release on February 26, 2026 due to regressions introduced in the February 12, 2026 update release, which included releases 18.2, 17.8, 16.12, 15.16, and 14.21. This release will provide fixes for all supported versions (18.3, 17.9, 16.13, 15.17, 14.22). While these fixes may not impact all PostgreSQL users, the PostgreSQL Global Development Group wants to address these issues before the next scheduled release on May 14, 2026.

The regressions from this release include:

• The substring() function raises an error "invalid byte sequence for encoding" on non-ASCII text values if the source of that value is a database column.
• A standby may halt and return an error "could not access status of transaction".

For the substring() regression, the fix for CVE-2026-2006, which closed a vulnerability in the database server, introduced a regression causing substring() to improperly return an error on multi-byte (non-ASCII) text values if the source of that value was a database column. If you've upgraded to 18.2, 17.8, 16.12, 15.16, or 14.21, and need the fix ahead of the February 26, 2026 release, you should consider manually applying the changes. Release specific information can be found here: https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes.

Ahead of this release, you can find additional information about the regressions and fixes here: https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes.

Original source

This release contains a variety of fixes from 18.1. For information about new features in major release 18, see Section E.5.

A dump/restore is not required for those running 18.X.

However, if you have any indexes on ltree columns, it may be necessary to reindex them after updating. See the sixth changelog entry below.

Guard against unexpected dimensions of oidvector / int2vector (Tom Lane)

These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without verifying them, and could misbehave in consequence.

The PostgreSQL Project thanks Altan Birler for reporting this problem. (CVE-2026-2003)

Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane)

contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type. Third-party extensions should check for similar hazards and add defenses using the technique intarray now uses. Since such extension fixes will take time, we now require superuser privilege to attach a non-built-in selectivity estimator to an operator.

The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2004)

Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier)

Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution.

The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2005)

Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch)

Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for encoding” errors when string functions process invalid text that has been stored in the database.

The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2006)

Harden contrib/pg_trgm against changes in string lowercasing behavior (Heikki Linnakangas)

Fix potential buffer overruns arising from the fact that in some locales lower-casing a string can produce more characters (not bytes) than were in the original. That behavior is new in version 18, and so is the bug.

The PostgreSQL Project thanks Heikki Linnakangas for reporting this problem. (CVE-2026-2007)

Fix inconsistent case-insensitive matching in contrib/ltree (Jeff Davis)

Index-related routines in ltree used a different implementation of case-folding than the primary operators did. Their behavior was equivalent only if the default collation provider was libc and the encoding was single-byte.

To fix, change the code to use case-folding with the database's default collation. This change will require reindexing indexes on ltree columns (regardless of the index access method) unless the database uses libc as collation provider and its encoding is single-byte. Without that, searches of such indexes will fail to locate relevant entries.

When using ALTER TABLE ... ADD CONSTRAINT to add a not-null constraint with an explicit name, if the column is already marked NOT NULL, require that the provided name match the existing constraint name (Álvaro Herrera, Srinath Reddy Sadipiralla)

Don't allow CTE references in sub-selects to determine semantic levels of aggregate functions (Tom Lane)

This change undoes a change made two minor releases ago, instead throwing an error if a sub-select references a CTE that's below the semantic level that standard SQL rules would assign to the aggregate based on contained column references and aggregates. The attempted fix turned out to cause problems of its own, and it's unclear what to do instead. Since sub-selects within aggregates are disallowed altogether by the SQL standard, treating such cases as errors seems sufficient.

Fix trigger transition table capture for MERGE in CTE queries (Dean Rasheed)

When executing a data-modifying CTE query containing both a MERGE and another DML operation on a table with statement-level AFTER triggers, the transition tables passed to the triggers would not include the rows affected by the MERGE, only those affected by the other operation(s).

Fix incorrect pruning of rowmarks belonging to non-relation rangetable entries, such as subqueries (Dean Rasheed)

This led to incorrect results if a proposed row update needed to be modified by EvalPlanQual rechecking, as could happen if there was a concurrent update to that row.

Fix failure when all children of a partitioned target table of an update or delete have been pruned (Amit Langote)

In such cases, the executor could report “could not find junk ctid column” errors, even though nothing needs to be done.

Fix expression evaluation bug for a sub-select within an array subscript (Andres Freund)

Fix text substring search for non-deterministic collations (Laurenz Albe)

When using a non-deterministic collation, we failed to detect a match occurring at the very end of the searched string.

Avoid possible planner failure when a query contains duplicate window function calls (Meng Zhang, David Rowley)

Confusion over de-duplication of such calls could result in errors like “WindowFunc with winref 2 assigned to WindowAgg with winref 1”.

Fix planner error with set-returning functions and grouping sets (Richard Guo)

When constructing a ProjectSet plan node, the planner failed to detect that subexpressions involving grouping expressions were already computed by the input plan. This led to inefficient plans or errors such as “variable not found in subplan target list”.

Avoid incorrect optimization when a subquery's grouping clause contains a volatile or set-returning function (Richard Guo)

The planner was willing to push down outer-query restrictions referencing such a grouping column, leading to incorrect behavior due to multiple evaluation of a volatile function, or errors caused by introduction of a set-returning function into the subquery's WHERE / HAVING clauses.

Look through PlaceHolderVar nodes when searching for statistics about an expression (Richard Guo)

This change allows the planner to find relevant statistics about expressions pulled up from subqueries or used in GROUP BY, avoiding falling back to a default estimate. (Arguably we should adjust any found statistics to account for an increased probability of the value being NULL, but we've never done the equivalent thing for plain Vars either.) While this restriction is old, changes in PostgreSQL version 18 made PlaceHolderVars more common than before, so make the change to avoid plan regressions in affected cases.

Look through no-op PlaceHolderVar nodes when matching expressions to indexes (Richard Guo)

Because PostgreSQL version 18 uses PlaceHolderVars in more cases than before, some queries that formerly could use an index failed to do so. Add logic to prevent that regression.

Fix planner's conversion of OR clauses to ScalarArrayOp index conditions (Tender Wang, Tom Lane)

The code did not handle RelabelType nodes correctly, and could generate invalid expressions or fail to perform a valid conversion.

Allow indexscans on partial hash indexes even when the index's predicate implies the truth of the WHERE clause (Tom Lane)

Normally we drop a WHERE clause that is implied by the predicate, since it's pointless to test it; it must hold for every index entry. However that can prevent creation of an indexscan plan if the index is one that requires a WHERE clause on the leading index key, as hash indexes do. Don't drop implied clauses when considering such an index.

Do not emit WAL for unlogged BRIN indexes (Kirill Reshke)

One seldom-taken code path incorrectly emitted a WAL record relating to a BRIN index even if the index was marked unlogged. Crash recovery would then fail to replay that record, complaining that the file already exists.

Use the correct ordering function in parallel GIN index builds (Tomas Vondra)

The parallel code used the default ordering operator (which is determined by the column data type's btree opclass), whereas it should use the ordering function specified by the GIN opclass, if any. This led to a failure if the data type has no btree opclass, or to an invalid index if the opclass specifies an ordering function that doesn't agree with the btree opclass.

Prevent truncation of CLOG that is still needed by unread NOTIFY messages (Joel Jacobson, Heikki Linnakangas)

This fix prevents “could not access status of transaction” errors when a backend is slow to absorb NOTIFY messages.

Escalate errors occurring during NOTIFY message processing to FATAL, i.e. close the connection (Heikki Linnakangas)

Formerly, if a backend got an error while absorbing a NOTIFY message, it would advance past that message, report the error to the client, and move on. That behavior was fraught with problems though. One big concern is that the client has no good way to know that a notification was lost, and certainly no way to know what was in it. Depending on the application logic, missing a notification could cause the application to get stuck waiting, for example. Also, any remaining messages would not get processed until someone sent a new NOTIFY.

Also, if the connection is idle at the time of receiving a NOTIFY signal, any ERROR would be escalated to FATAL anyway, due to unrelated concerns. Therefore, we've chosen to make that happen in all cases, for consistency and to provide a clear signal to the application that it might have missed some notifications.

Consider grouping expressions when computing a query ID hash (Jian He)

Previously, two queries that were the same except in GROUP BY expressions would be merged by contrib/pg_stat_statements and other users of query IDs.

Fix erroneous counting of updates in EXPLAIN ANALYZE MERGE with a concurrent update (Dean Rasheed)

This situation led to an incorrect count of “skipped” tuples in EXPLAIN's output, or to an assertion failure in an assert-enabled build.

Fix bug in following update chain when locking a tuple (Jasper Smit)

This code path neglected to check the xmin of the first new tuple in the update chain, making it possible to lock an unrelated tuple if the original updater aborted and the space was immediately reclaimed by VACUUM and then re-used. That could cause unexpected transaction delays or deadlocks. Errors associated with having identified the wrong tuple have also been observed.

Fix incorrect handling of incremental backups of large tables (Robert Haas, Oleg Tkachenko)

If a table exceeding 1GB (or in general, the installation's segment size) is truncated by VACUUM between the base backup and the incremental backup, pg_combinebackup could fail with an error about “truncation block length in excess of segment size”. This prevented restoring the incremental backup.

Fix potential backend process crash at process exit due to trying to release a lock in an already-unmapped shared memory segment (Rahila Syed)

Fix race condition in async I/O code (Andres Freund)

It was possible for the result code of an asynchronous I/O operation to be overwritten before it was fetched.

Guard against incorrect truncation of the multixact log after a crash (Heikki Linnakangas)

Fix possibly mis-encoded result of pg_stat_get_backend_activity() (Chao Li)

The shared-memory buffer holding a session's activity string can end with an incomplete multibyte character. Readers are supposed to truncate off any such incomplete character, but this function failed to do so.

Guard against recursive memory context logging (Fujii Masao)

A constant flow of signals requesting memory context logging could cause recursive execution of the logging code, which in theory could lead to stack overflow.

Fix memory context usage when reinitializing a parallel execution context (Jakub Wartak, Jeevan Chalke)

This error could result in a crash due to a subsidiary data structure having a shorter lifespan than the parallel context. The problem is not known to be reachable using only core PostgreSQL, but we have reports of trouble in extensions.

Set next multixid's offset when creating a new multixid, to remove the wait loop that was needed in corner cases (Andrey Borodin)

The previous logic could get stuck waiting for an update that would never occur.

Avoid rewriting data-modifying CTEs more than once (Bernice Southey, Dean Rasheed)

Formerly, when updating an auto-updatable view or a relation with rules, if the original query had any data-modifying CTEs, the rewriter would rewrite those CTEs multiple times due to recursion. This was inefficient and could produce false errors if a CTE included an update of an always-generated column.

Allow retrying initialization of a DSM registry entry (Nathan Bossart)

If we fail partway through initialization of a dynamic shared memory entry, allow the next attempt to use that entry to retry initialization. Previously the entry was left in a permanently-failed state.

Avoid failure of NUMA status views when a page has been swapped out (Tomas Vondra)

Avoid “operation not permitted” errors when querying NUMA page status with older libnuma versions (Tomas Vondra)

Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record (Nitin Jadhav)

Add an explicit check for this before starting recovery, so that no harm is done and a useful error message is provided. Previously, recovery might crash or corrupt the database in this situation.

Avoid scribbling on the source query tree during ALTER PUBLICATION (Sunil S)

This error had the visible effect that an event trigger fired for the query would see only the first publish option, even if several had been specified. If such a query were set up as a prepared statement, re-executions would misbehave too.

Pass connection options specified in CREATE SUBSCRIPTION ... CONNECTION to the publisher's walsender (Fujii Masao)

Before this fix, the options connection option (if any) was ignored, thus for example preventing setting custom server parameter values in the walsender session. It was intended for that to work, and it did work before refactoring in PostgreSQL version 15 broke it, so restore the previous behavior.

Prevent invalidation of newly created or newly synced replication slots (Zhijie Hou)

A race condition with a concurrent checkpoint could allow WAL to be removed that is needed by the replication slot, causing the slot to immediately get marked invalid.

Fix race condition in computing a replication slot's required xmin (Zhijie Hou)

This could lead to the error “cannot build an initial slot snapshot as oldest safe xid follows snapshot's xmin”.

During initial synchronization of a logical replication subscription, commit the addition of a pg_replication_origin entry before starting to copy data (Zhijie Hou)

Previously, if the copy step failed, the new pg_replication_origin entry would be lost due to transaction rollback. This led to inconsistent state in shared memory.

Don't advance logical replication progress after a parallel worker apply failure (Zhijie Hou)

The previous behavior allowed transactions to be lost by a subscriber.

Fix logical replication slotsync worker processes to handle LOCK_TIMEOUT signals correctly (Zhijie Hou)

Previously, timeout signals were effectively ignored.

Fix possible failure with “unexpected data beyond EOF” during restart of a streaming replica server (Anthonin Bonnefoy)

Fix error reporting for SQL/JSON path type mismatches (Jian He)

The code could produce a “cache lookup failed for type 0” error instead of the intended complaint about the path expression not being of the right type.

Fix erroneous tracking of column position when parsing partition range bounds (myzhen)

This could, for example, lead to the wrong column name being cited in error messages about casting partition bound values to the column's data type.

Fix assorted minor errors in error messages (Man Zeng, Tianchen Zhang)

For example, an error report about mismatched timeline number in a backup manifest showed the starting timeline number where it meant to show the ending timeline number.

Fix failure to perform function inlining when doing JIT compilation with LLVM version 17 or later (Anthonin Bonnefoy)

Adjust our JIT code to work with LLVM 21 (Holger Hoffstätte)

The previous coding failed to compile on aarch64 machines.

Fix aarch64-specific code to build with old (RHEL7-era) system header files (Tom Lane)

Fix incorrect configure probe for io_uring_queue_init_mem() (Masahiko Sawada)

This error resulted in failure to optimize async I/O buffer allocations in autotools-based builds, though the code did work when building with meson. The main impact of the omission was slower-than-necessary backend process exits.

Add new server parameter file_extend_method to control use of posix_fallocate() (Thomas Munro)

PostgreSQL version 16 and later will use posix_fallocate(), if the platform provides it, to extend relation files. However, this has been reported to interact poorly with some file systems: BTRFS compression is disabled by the use of posix_fallocate(), and XFS could produce spurious ENOSPC errors in older Linux kernel versions. To provide a workaround, introduce this new server parameter. Setting file_extend_method to write_zeros will cause the server to return to the old method of extending files by writing blocks of zeroes.

Honor open()'s O_CLOEXEC flag on Windows (Bryan Green, Thomas Munro)

Make this flag work like it does on POSIX platforms, so that we don't leak file handles into child processes such as COPY TO/FROM PROGRAM. While that leakage hasn't caused many problems, it seems undesirable.

Fix failure to parse long options on the server command line in Solaris executables built with meson (Tom Lane)

Support process title changes on GNU/Hurd (Michael Banck)

Fix psql's tab completion for VACUUM option values (Yugo Nagata)

In psql command prompts, do not show a value for %P (pipeline status) when there is no server connection (Chao Li)

This makes %P act like other prompt escape sequences whose values depend on the active connection.

Fix pg_dump's logic for collecting sequence values (Nathan Bossart)

pg_dump failed if a sequence was dropped concurrently with the dump, even if the sequence was not among the database objects to be dumped. Also, if the calling user lacks privileges to read a sequence's value, pg_dump emitted incorrect values rather than failing as expected.

Fix potentially-incorrect quoting of oauth_validator_libraries values by pg_dump (ChangAo Chen)

pg_dump applied the wrong quoting rule if it needed to dump a value of this setting.

Avoid pg_dump assertion failure in binary-upgrade mode (Vignesh C)

Failure to handle subscription-relation objects in the object sorting code triggered an assertion, though there were no serious ill effects in production builds.

Fix incorrect error handling in pgbench with multiple \syncpipeline commands in pipeline mode (Yugo Nagata)

If multiple \syncpipeline commands are encountered after a query error, pgbench would report “failed to exit pipeline mode”, or get an assertion failure in an assert-enabled build.

Make pg_resetwal print the updated value when changing OldestXID (Heikki Linnakangas)

It already did that for every other variable it can change.

Make pg_resetwal allow setting next multixact xid to 0 or next multixact offset to UINT32_MAX (Maxim Orlov)

These are valid values, so rejecting them was incorrect. In the worst case, if a pg_upgrade is attempted when exactly at the point of multixact wraparound, the upgrade would fail.

In contrib/amcheck, use the correct snapshot for btree index parent checks (Mihail Nikalayeu)

The previous coding caused spurious errors when examining indexes created with CREATE INDEX CONCURRENTLY.

Fix contrib/amcheck to handle “half-dead” btree index pages correctly (Heikki Linnakangas)

amcheck expected such a page to have a parent downlink, but it does not, leading to a false error report about “mismatch between parent key and child high key”.

Fix contrib/amcheck to handle incomplete btree root page splits correctly (Heikki Linnakangas)

amcheck could report a false error about “block is not true root”.

Fix excessive memory allocation in contrib/pg_buffercache (David Geier)

The code allocated twice as much memory as it needed for NUMA page status.

Fix edge-case integer overflow in contrib/intarray's selectivity estimator for @@ (Chao Li)

This could cause poor selectivity estimates to be produced for cases involving the maximum integer value.

Fix multibyte-encoding issue in contrib/ltree (Jeff Davis)

The previous coding could pass an incomplete multibyte character to lower(), probably resulting in incorrect behavior.

Avoid crash in contrib/pg_stat_statements when an IN list contains both constants and non-constant expressions (Sami Imseih)

Update time zone data files to tzdata release 2025c (Tom Lane)

The only change is in historical data for pre-1976 timestamps in Baja California.

Original source

This release contains a variety of fixes from 17.7. For information about new features in major release 17, see Section E.11.

A dump/restore is not required for those running 17.X.
However, if you are upgrading from a version earlier than 17.6, see Section E.5.

• Guard against unexpected dimensions of oidvector / int2vector (Tom Lane) §

  These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without verifying them, and could misbehave in consequence.
  The PostgreSQL Project thanks Altan Birler for reporting this problem. (CVE-2026-2003)

• Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) § § §

  contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type. Third-party extensions should check for similar hazards and add defenses using the technique intarray now uses. Since such extension fixes will take time, we now require superuser privilege to attach a non-built-in selectivity estimator to an operator.
  The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2004)

• Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) §

  Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution.
  The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2005)

• Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) § § § § § § §

  Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for encoding” errors when string functions process invalid text that has been stored in the database.
  The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2006)

• Don't allow CTE references in sub-selects to determine semantic levels of aggregate functions (Tom Lane) §

  This change undoes a change made two minor releases ago, instead throwing an error if a sub-select references a CTE that's below the semantic level that standard SQL rules would assign to the aggregate based on contained column references and aggregates. The attempted fix turned out to cause problems of its own, and it's unclear what to do instead. Since sub-selects within aggregates are disallowed altogether by the SQL standard, treating such cases as errors seems sufficient.

• Fix trigger transition table capture for MERGE in CTE queries (Dean Rasheed) §

  When executing a data-modifying CTE query containing both a MERGE and another DML operation on a table with statement-level AFTER triggers, the transition tables passed to the triggers would not include the rows affected by the MERGE, only those affected by the other operation(s).

• Fix failure when all children of a partitioned target table of an update or delete have been pruned (Amit Langote) §

  In such cases, the executor could report “could not find junk ctid column” errors, even though nothing needs to be done.

• Avoid possible planner failure when a query contains duplicate window function calls (Meng Zhang, David Rowley) §

  Confusion over de-duplication of such calls could result in errors like “WindowFunc with winref 2 assigned to WindowAgg with winref 1”.

• Allow indexscans on partial hash indexes even when the index's predicate implies the truth of the WHERE clause (Tom Lane) §

  Normally we drop a WHERE clause that is implied by the predicate, since it's pointless to test it; it must hold for every index entry. However that can prevent creation of an indexscan plan if the index is one that requires a WHERE clause on the leading index key, as hash indexes do. Don't drop implied clauses when considering such an index.

• Do not emit WAL for unlogged BRIN indexes (Kirill Reshke) §

  One seldom-taken code path incorrectly emitted a WAL record relating to a BRIN index even if the index was marked unlogged. Crash recovery would then fail to replay that record, complaining that the file already exists.

• Prevent truncation of CLOG that is still needed by unread NOTIFY messages (Joel Jacobson, Heikki Linnakangas) § § §

  This fix prevents “could not access status of transaction” errors when a backend is slow to absorb NOTIFY messages.

• Escalate errors occurring during NOTIFY message processing to FATAL, i.e. close the connection (Heikki Linnakangas) §

  Formerly, if a backend got an error while absorbing a NOTIFY message, it would advance past that message, report the error to the client, and move on. That behavior was fraught with problems though. One big concern is that the client has no good way to know that a notification was lost, and certainly no way to know what was in it. Depending on the application logic, missing a notification could cause the application to get stuck waiting, for example. Also, any remaining messages would not get processed until someone sent a new NOTIFY.
  Also, if the connection is idle at the time of receiving a NOTIFY signal, any ERROR would be escalated to FATAL anyway, due to unrelated concerns. Therefore, we've chosen to make that happen in all cases, for consistency and to provide a clear signal to the application that it might have missed some notifications.

• Fix erroneous counting of updates in EXPLAIN ANALYZE MERGE with a concurrent update (Dean Rasheed) §

  This situation led to an incorrect count of “skipped” tuples in EXPLAIN's output, or to an assertion failure in an assert-enabled build.

• Fix bug in following update chain when locking a tuple (Jasper Smit) §

  This code path neglected to check the xmin of the first new tuple in the update chain, making it possible to lock an unrelated tuple if the original updater aborted and the space was immediately reclaimed by VACUUM and then re-used. That could cause unexpected transaction delays or deadlocks. Errors associated with having identified the wrong tuple have also been observed.

• Fix issues around in-place catalog updates (Noah Misch) § § §

  Send a nontransactional invalidation message for an in-place update, since such an update will survive transaction rollback. Also ensure that the update is WAL-logged before other sessions can see it. These fixes primarily prevent scenarios in which relations' frozen-XID attributes become inconsistent, possibly allowing premature CLOG truncation and subsequent “could not access status of transaction” errors.

• Fix incorrect handling of incremental backups of large tables (Robert Haas, Oleg Tkachenko) §

  If a table exceeding 1GB (or in general, the installation's segment size) is truncated by VACUUM between the base backup and the incremental backup, pg_combinebackup could fail with an error about “truncation block length in excess of segment size”. This prevented restoring the incremental backup.

• Fix potential backend process crash at process exit due to trying to release a lock in an already-unmapped shared memory segment (Rahila Syed) §

• Guard against incorrect truncation of the multixact log after a crash (Heikki Linnakangas) §

• Fix possibly mis-encoded result of pg_stat_get_backend_activity() (Chao Li) §

  The shared-memory buffer holding a session's activity string can end with an incomplete multibyte character. Readers are supposed to truncate off any such incomplete character, but this function failed to do so.

• Guard against recursive memory context logging (Fujii Masao) §

  A constant flow of signals requesting memory context logging could cause recursive execution of the logging code, which in theory could lead to stack overflow.

• Fix memory context usage when reinitializing a parallel execution context (Jakub Wartak, Jeevan Chalke) §

  This error could result in a crash due to a subsidiary data structure having a shorter lifespan than the parallel context. The problem is not known to be reachable using only core PostgreSQL, but we have reports of trouble in extensions.

• Set next multixid's offset when creating a new multixid, to remove the wait loop that was needed in corner cases (Andrey Borodin) § §

  The previous logic could get stuck waiting for an update that would never occur.

• Avoid rewriting data-modifying CTEs more than once (Bernice Southey, Dean Rasheed) §

  Formerly, when updating an auto-updatable view or a relation with rules, if the original query had any data-modifying CTEs, the rewriter would rewrite those CTEs multiple times due to recursion. This was inefficient and could produce false errors if a CTE included an update of an always-generated column.

• Allow retrying initialization of a DSM registry entry (Nathan Bossart) §

  If we fail partway through initialization of a dynamic shared memory entry, allow the next attempt to use that entry to retry initialization. Previously the entry was left in a permanently-failed state.

• Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record (Nitin Jadhav) §

  Add an explicit check for this before starting recovery, so that no harm is done and a useful error message is provided. Previously, recovery might crash or corrupt the database in this situation.

• Avoid scribbling on the source query tree during ALTER PUBLICATION (Sunil S) §

  This error had the visible effect that an event trigger fired for the query would see only the first publish option, even if several had been specified. If such a query were set up as a prepared statement, re-executions would misbehave too.

• Pass connection options specified in CREATE SUBSCRIPTION ... CONNECTION to the publisher's walsender (Fujii Masao) §

  Before this fix, the options connection option (if any) was ignored, thus for example preventing setting custom server parameter values in the walsender session. It was intended for that to work, and it did work before refactoring in PostgreSQL version 15 broke it, so restore the previous behavior.

• Prevent invalidation of newly created or newly synced replication slots (Zhijie Hou) § § §

  A race condition with a concurrent checkpoint could allow WAL to be removed that is needed by the replication slot, causing the slot to immediately get marked invalid.

• Fix race condition in computing a replication slot's required xmin (Zhijie Hou) §

  This could lead to the error “cannot build an initial slot snapshot as oldest safe xid follows snapshot's xmin”.

• During initial synchronization of a logical replication subscription, commit the addition of a pg_replication_origin entry before starting to copy data (Zhijie Hou) §

  Previously, if the copy step failed, the new pg_replication_origin entry would be lost due to transaction rollback. This led to inconsistent state in shared memory.

• Don't advance logical replication progress after a parallel worker apply failure (Zhijie Hou) §

  The previous behavior allowed transactions to be lost by a subscriber.

• Fix logical replication slotsync worker processes to handle LOCK_TIMEOUT signals correctly (Zhijie Hou) §

  Previously, timeout signals were effectively ignored.

• Fix possible failure with “unexpected data beyond EOF” during restart of a streaming replica server (Anthonin Bonnefoy) §

• Fix error reporting for SQL/JSON path type mismatches (Jian He) §

  The code could produce a “cache lookup failed for type 0” error instead of the intended complaint about the path expression not being of the right type.

• Fix erroneous tracking of column position when parsing partition range bounds (myzhen) §

  This could, for example, lead to the wrong column name being cited in error messages about casting partition bound values to the column's data type.

• Fix assorted minor errors in error messages (Man Zeng, Tianchen Zhang) § § § § §

  For example, an error report about mismatched timeline number in a backup manifest showed the starting timeline number where it meant to show the ending timeline number.

• Fix failure to perform function inlining when doing JIT compilation with LLVM version 17 or later (Anthonin Bonnefoy) §

• Adjust our JIT code to work with LLVM 21 (Holger Hoffstätte) §

  The previous coding failed to compile on aarch64 machines.

• Add new server parameter file_extend_method to control use of posix_fallocate() (Thomas Munro) §

  PostgreSQL version 16 and later will use posix_fallocate(), if the platform provides it, to extend relation files. However, this has been reported to interact poorly with some file systems: BTRFS compression is disabled by the use of posix_fallocate(), and XFS could produce spurious ENOSPC errors in older Linux kernel versions. To provide a workaround, introduce this new server parameter. Setting file_extend_method to write_zeros will cause the server to return to the old method of extending files by writing blocks of zeroes.

• Honor open()'s O_CLOEXEC flag on Windows (Bryan Green, Thomas Munro) § § §

  Make this flag work like it does on POSIX platforms, so that we don't leak file handles into child processes such as COPY TO/FROM PROGRAM. While that leakage hasn't caused many problems, it seems undesirable.

• Fix failure to parse long options on the server command line in Solaris executables built with meson (Tom Lane) §

• Support process title changes on GNU/Hurd (Michael Banck) §

• Avoid pg_dump assertion failure in binary-upgrade mode (Vignesh C) §

  Failure to handle subscription-relation objects in the object sorting code triggered an assertion, though there were no serious ill effects in production builds.

• Fix incorrect error handling in pgbench with multiple \syncpipeline commands in pipeline mode (Yugo Nagata) §

  If multiple \syncpipeline commands are encountered after a query error, pgbench would report “failed to exit pipeline mode”, or get an assertion failure in an assert-enabled build.

• Make pg_resetwal print the updated value when changing OldestXID (Heikki Linnakangas) §

  It already did that for every other variable it can change.

• Make pg_resetwal allow setting next multixact xid to 0 or next multixact offset to UINT32_MAX (Maxim Orlov) §

  These are valid values, so rejecting them was incorrect. In the worst case, if a pg_upgrade is attempted when exactly at the point of multixact wraparound, the upgrade would fail.

• In contrib/amcheck, use the correct snapshot for btree index parent checks (Mihail Nikalayeu) § §

  The previous coding caused spurious errors when examining indexes created with CREATE INDEX CONCURRENTLY.

• Fix contrib/amcheck to handle “half-dead” btree index pages correctly (Heikki Linnakangas) §

  amcheck expected such a page to have a parent downlink, but it does not, leading to a false error report about “mismatch between parent key and child high key”.

• Fix contrib/amcheck to handle incomplete btree root page splits correctly (Heikki Linnakangas) §

  amcheck could report a false error about “block is not true root”.

• Fix edge-case integer overflow in contrib/intarray's selectivity estimator for @@ (Chao Li) §

  This could cause poor selectivity estimates to be produced for cases involving the maximum integer value.

• Fix multibyte-encoding issue in contrib/ltree (Jeff Davis) §

  The previous coding could pass an incomplete multibyte character to lower(), probably resulting in incorrect behavior.

• Update time zone data files to tzdata release 2025c (Tom Lane) §

  The only change is in historical data for pre-1976 timestamps in Baja California.

Original source

Security Issues

CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory: PostgreSQL oidvector discloses a few bytes of memory
CVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 14 - 18.
Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Altan Birler for reporting this problem.

CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVSS v3.1 Base Score: 8.8
Supported, Vulnerable Versions: 14 - 18.
Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem.

CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
CVSS v3.1 Base Score: 8.2
Supported, Vulnerable Versions: 18.
Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
The PostgreSQL project thanks Heikki Linnakangas for reporting this problem.

Bug Fixes and Improvements

This update fixes over 65 bugs that were reported in the last several months. The issues listed below affect PostgreSQL 18. Some of these issues may also affect other supported versions of PostgreSQL.

• Fix inconsistent case-insensitive text matching in the ltree extension. If you use an index on an ltree column, in some cases you may need perform a reindex. See the "Updating" section for additional instructions.
• Executing ALTER TABLE ... ADD CONSTRAINT to add a NOT NULL constraint on a column that already is marked as NOT NULL now requires the constraint name to match the existing constraint name.
• Fix trigger behavior when MERGE is executed from a WITH query to include rows affected by the MERGE.
• Several query planner fixes.
• Fix for text substring search for non-deterministic collations.
• Several fixes for NOTIFY error handling and reporting.
• Use the correct ordering function in GIN index parallel builds.
• Fix incorrect handling of incremental backups with tables larger than 1GB.
• Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record.
• Fix for ALTER PUBLICATION to ensure event triggers contain all set options.
• Several fixes around replication slot initialization.
• Don't advance replication slot after a logical replication parallel worker apply failure to prevent transaction loss on the subscriber.
• Fix error reporting for SQL/JSON path type mismatches.
• Fix JIT compilation function inlining when using LLVM 17 or later.
• Add new server parameter file_extend_method to control use of posix_fallocate().
• Fix psql tab completion for the VACUUM command options.
• Fix pg_dump to handle concurrent sequence drops gracefully and to fail if the calling user explicitly lacks privileges to read the sequence.
• Several fixes for amcheck around btree inspection.
• Avoid crash in pg_stat_statements when an IN list contains both constants and non-constant expressions.

This release also updates time zone data files to tzdata release 2025c, which only has a historical data change for pre-1976 timestamps in Baja California.

Updating

All PostgreSQL update releases are cumulative. As with other minor releases, users are not required to dump and reload their database or use pg_upgrade in order to apply this update release; you may simply shutdown PostgreSQL and update its binaries.

If you have indexes on ltree columns and do not use the libc collation provider, after upgrading to the latest version, you must reindex any ltree column. You can use REINDEX INDEX CONCURRENTLY to minimize the impact on your system.

Users who have skipped one or more update releases may need to run additional post-update steps; please see the release notes from earlier versions for details.

For more details, please see the release notes.

Links

• Download
• Release Notes
• Security
• Versioning Policy
• Submit a Bug
• Donate

If you have corrections or suggestions for this release announcement, please send them to the [email protected] public mailing list.

Original source

This release contains a variety of fixes from 18.0. For information about new features in major release 18, see Section E.5.

A dump/restore is not required for those running 18.X.

Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte Fennema-Nio)

This omission allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts.

The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2025-12817)

Avoid integer overflow in allocation-size calculations within libpq (Jacob Champion)

Several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer.

The PostgreSQL Project thanks Aleksey Solovev of Positive Technologies for reporting this problem. (CVE-2025-12818)

Prevent “unrecognized node type” errors when a SQL/JSON function such as JSON_VALUE has a DEFAULT clause containing a COLLATE expression (Jian He)

Avoid incorrect optimization of variable-free HAVING clauses with grouping sets (Richard Guo)

Do not use parallelism in hash right semi joins (Richard Guo)

The case does not work reliably due to a race condition in updating the join's shared hash table.

Avoid possible division-by-zero when creating ordered-append plans (Richard Guo)

This mistake could result in incorrect selection of the cheapest path, or in an assertion failure in debug builds.

Fix planner failure with index types that can do ordered access but not index-only scans (Maxime Schoemans)

This oversight resulted in errors like “no data returned for index-only scan”. The case does not arise with any in-core index type, but some extensions encountered the problem.

Remove faulty assertion in btree index cleanup (Peter Geoghegan)

Avoid possible out-of-memory or “invalid memory alloc request size” failures during parallel GIN index build (Tomas Vondra)

Ensure that BRIN autosummarization provides a snapshot for index expressions that need one (Álvaro Herrera)

Previously, autosummarization would fail for such indexes, and then leave placeholder index tuples behind, causing the index to bloat over time.

Fix integer-overflow hazard in BRIN index scans when the table contains close to 2^32 pages (Sunil S)

This oversight could result in an infinite loop or scanning of unneeded table pages.

Fix incorrect zero-extension of stored values in JIT-generated tuple deforming code (David Rowley)

When not using JIT, the equivalent code does sign-extension not zero-extension, leading to a different Datum representation of small integer data types. This inconsistency was masked in most cases, but it is known to lead to “could not find memoization table entry” errors when using Memoize plan nodes, and there might be other symptoms.

Fix rare crash when processing hashed GROUPING SETS queries (David Rowley)

Repair faulty hash-table-size-choosing logic in hash joins (Tomas Vondra)

Hash joins sometimes used more memory than intended, or failed to divide it in an efficient way.

Improve relation lookup logic in statistics manipulation functions (Nathan Bossart)

Fix pg_restore_relation_stats(), pg_clear_relation_stats(), pg_restore_attribute_stats(), and pg_clear_attribute_stats() to check privileges before acquiring lock on the target relation rather than after.

Fix incorrect logic for caching result-relation information for triggers (David Rowley, Amit Langote)

In cases where partitions' column sets aren't physically identical to their parent partitioned tables' column sets, this oversight could lead to crashes.

Fix crash during EvalPlanQual rechecks on partitioned tables (David Rowley, Amit Langote)

Fix EvalPlanQual handling of foreign or custom joins that do not have an alternative local-join plan prepared for EPQ (Masahiko Sawada, Etsuro Fujita)

In such cases the foreign or custom access method should be invoked normally, but that did not happen, typically leading to a crash.

Avoid duplicating hash partition constraints during DETACH CONCURRENTLY (Haiyang Li)

ALTER TABLE DETACH PARTITION CONCURRENTLY was written to add a copy of the partitioning constraint to the now-detached partition. This was misguided, partially because non-concurrent DETACH doesn't do that, but mostly because in the case of hash partitioning the constraint expression contains references to the parent table's OID. That causes problems during dump/restore, or if the parent table is dropped after DETACH. In v19 and later, we'll no longer create any such copied constraints at all. In released branches, to minimize the risk of unforeseen consequences, only skip adding a copied constraint if it is for hash partitioning.

Disallow generated columns in partition keys (Jian He, Ashutosh Bapat)

This was already not allowed, but the check missed some cases, such as where the column reference is implicit in a whole-row reference.

Disallow generated columns in COPY ... FROM ... WHERE clauses (Peter Eisentraut, Jian He)

Previously, incorrect behavior or an obscure error message resulted from attempting to reference such a column, since generated columns have not yet been computed at the point where WHERE filtering is done.

Prevent setting a column as identity if it has a not-null constraint but the constraint is marked as invalid (Jian He)

Identity columns must be not-null, but the check for that missed this edge case.

Avoid potential use-after-free in parallel vacuum (Kevin Oommen Anish)

This bug seems to have no consequences in standard builds, but it's theoretically a hazard.

Fix visibility checking for statistics objects in pg_temp (Noah Misch)

A statistics object located in a temporary schema cannot be named without schema qualification, but pg_statistics_obj_is_visible() missed that memo and could return “true” regardless. In turn, functions such as pg_describe_object() could fail to schema-qualify the object's name as expected.

Fix minor memory leak during WAL replay of database creation (Nathan Bossart)

Fix incorrect reporting of replication lag in pg_stat_replication view (Fujii Masao)

If any standby server's replay LSN stopped advancing, the write_lag and flush_lag columns would eventually stop updating.

Avoid duplicative log messages about invalid primary_slot_name settings (Fujii Masao)

Avoid failures when synchronized_standby_slots references nonexistent replication slots (Shlok Kyal)

Remove the unfinished slot state file after failing to write a replication slot's state to disk (Michael Paquier)

Previously, a failure such as out-of-disk-space resulted in leaving a temporary state.tmp file behind. That's problematic because it would block all subsequent attempts to write the state, requiring manual intervention to clean up.

Fix mishandling of lock timeout signals in parallel apply workers for logical replication (Hayato Kuroda)

The same signal number was being used for both worker shutdown and lock timeout, leading to confusion.

Avoid unwanted WAL receiver shutdown when switching from streaming to archive WAL source (Xuneng Zhou)

During a timeline change, a standby server's WAL receiver should remain alive, waiting for a new WAL streaming start point. Instead it was repeatedly shutting down and immediately getting restarted, which could confuse status monitoring code.

Fix use-after-free issue in the relation synchronization cache maintained by the pgoutput logical decoding plugin (Vignesh C, Masahiko Sawada)

An error during logical decoding could result in crashes in subsequent logical decoding attempts in the same session. The case is only reachable when pgoutput is invoked via SQL functions.

Avoid unnecessary invalidation of logical replication slots (Bertrand Drouvot)

Re-establish special case for C collation in locale setup (Jeff Davis)

This fixes a regression in access to shared catalogs early in backend startup, before a database has been selected. It is not known to be a problem for any core PostgreSQL code, but some extensions were broken.

Fix incorrect printing of messages about failures in checking whether the user has Windows administrator privilege (Bryan Green)

This code would have crashed or at least printed garbage. No such cases have been reported though, indicating that failure of these system calls is extremely rare.

Avoid crash when attempting to test PostgreSQL with certain libsanitizer options (Emmanuel Sibi, Jacob Champion)

Fix false memory-context-checking warnings in debug builds on 64-bit Windows (David Rowley)

Correctly handle GROUP BY DISTINCT in PL/pgSQL assignment statements (Tom Lane)

The parser failed to record the DISTINCT option in this context, so that the command would act as if it were plain GROUP BY.

Avoid leaking memory when handling a SQL error within PL/Python (Tom Lane)

This fixes a session-lifespan memory leak introduced in our previous minor releases.

Fix libpq's handling of socket-related errors on Windows within its GSSAPI logic (Ning Wu, Tom Lane)

The code for encrypting/decrypting transmitted data using GSSAPI did not correctly recognize error conditions on the connection socket, since Windows reports those differently than other platforms. This led to failure to make such connections on Windows.

Fix dumping of non-inherited not-null constraints on inherited table columns (Dilip Kumar)

pg_dump failed to preserve such constraints when dumping from a pre-v18 server.

Fix pg_dump's sorting of foreign key constraints (Álvaro Herrera)

Ensure consistent ordering of these database objects, as was already done for other object types.

Fix assorted errors in the data compression logic in pg_dump and pg_restore (Daniel Gustafsson, Tom Lane)

Error checking was missing or incorrect in several places, and there were also portability issues that would manifest on big-endian hardware. These problems had been missed because this code is only used to read compressed TOC files within directory-format dumps.

pg_dump never produces such a dump; the case can be reached only by manually compressing the TOC file after the fact, which is a supported thing to do but very uncommon.

Fix pgbench to error out cleanly if a COPY operation is started (Anthonin Bonnefoy)

pgbench doesn't intend to support this case, but previously it went into an infinite loop.

Fix pgbench's reporting of multiple errors (Yugo Nagata)

In cases where two successive PQgetResult calls both fail, pgbench might report the wrong error message.

In pgbench, fix faulty assertion about errors in pipeline mode (Yugo Nagata)

Fix per-file memory leakage in pg_combinebackup (Tom Lane)

Ensure that contrib/pg_buffercache functions can be canceled (Satyanarayana Narlapuram, Yuhang Qiu)

Some code paths were capable of running for a long time without checking for interrupts.

Fix contrib/pg_prewarm's privilege checks for indexes (Ayush Vatsa, Nathan Bossart)

pg_prewarm() requires SELECT privilege on relations to be prewarmed. However, since indexes have no SQL privileges of their own, this resulted in non-superusers being unable to prewarm indexes. Instead, check for SELECT privilege on the index's table.

In contrib/pg_stat_statements, avoid crash when two or more constants are marked as having the same location in the SQL statement text (Sami Imseih, Dmitry Dolgov)

Make contrib/pgstattuple more robust about empty or invalid index pages (Nitin Motiani)

Count all-zero pages as free space, and ignore pages that are invalid according to a check of the page's special-space size. The code for btree indexes already counted all-zero pages as free, but the hash and gist code would error out, which has been found to be much less user-friendly. Similarly, make all three cases agree on ignoring corrupted pages rather than throwing errors.

Harden our read and write barrier macros to satisfy Clang (Thomas Munro)

We supposed that __atomic_thread_fence() is a sufficient barrier to prevent the C compiler from re-ordering memory accesses around it, but it appears that that's not true for Clang, allowing it to generate incorrect code for at least RISC-V, MIPS, and LoongArch machines. Add explicit compiler barriers to fix that.

Fix PGXS build infrastructure to support building NLS po files for extensions (Ryo Matsumura)

Original source

This release contains a variety of fixes from 17.6. For information about new features in major release 17, see Section E.11.

A dump/restore is not required for those running 17.X.
However, if you are upgrading from a version earlier than 17.6, see Section E.5.

Fixes

• Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte Fennema-Nio) §
  This omission allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts.
  The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2025-12817)

• Avoid integer overflow in allocation-size calculations within libpq (Jacob Champion) §
  Several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which would then lead to writing past the end of the buffer.
  The PostgreSQL Project thanks Aleksey Solovev of Positive Technologies for reporting this problem. (CVE-2025-12818)

• Prevent “unrecognized node type” errors when a SQL/JSON function such as JSON_VALUE has a DEFAULT clause containing a COLLATE expression (Jian He) §

• Correctly treat JSON constructor expressions, such as JSON_OBJECT(), as non-strict (Tender Wang, Richard Guo) §
  In some cases these expressions can yield a non-null result despite having one or more null inputs, making them non-strict. The planner incorrectly classified them as strict and could perform incorrect query transformations as a result.

• Further fix processing of character classes within SIMILAR TO regular expressions (Laurenz Albe) §
  The previous fix for translating SIMILAR TO pattern matching expressions to POSIX-style regular expressions broke a corner case that formerly worked: if there is an escape character right after the opening bracket and then a closing bracket right after the escape sequence (for example [\w]), the closing bracket was no longer seen as terminating the character class.

• Fix parsing of aggregate functions whose arguments contain a sub-select with a FROM reference to a CTE outside the aggregate function (Tom Lane) §
  Such a CTE reference must act like a outer-level column reference when determining the aggregate's semantic level; but it was not being accounted for, leading to obscure planner or executor errors.

• Fix “no relation entry for relid” errors in corner cases while estimating SubPlan costs (Richard Guo) §

• Avoid unlikely use-after-free in planner's expansion of partitioned tables (Bernd Reiß) §
  There was a hazard only when the last live partition was concurrently dropped.

• Remove faulty assertion in btree index cleanup (Peter Geoghegan) §

• Fix possible infinite loop in GIN index scans with multiple scan conditions (Tom Lane) §
  GIN can handle scan conditions that can reject non-matching entries but are not useful for searching for relevant entries, for example a tsquery clause like !term. But such a condition must not be first in the array of scan conditions. The code failed to ensure that in all cases, with the result that a query having a mix of such conditions with normal conditions might work or not depending on the order in which the conditions were given in the query.

• Ensure that GIN index scans can be canceled (Tom Lane) §
  Some code paths were capable of running for a long time without checking for interrupts.

• Ensure that BRIN autosummarization provides a snapshot for index expressions that need one (Álvaro Herrera) §
  Previously, autosummarization would fail for such indexes, and then leave placeholder index tuples behind, causing the index to bloat over time.

• Fix integer-overflow hazard in BRIN index scans when the table contains close to 2⁳² pages (Sunil S) §
  This oversight could result in an infinite loop or scanning of unneeded table pages.

• Fix incorrect zero-extension of stored values in JIT-generated tuple deforming code (David Rowley) §
  When not using JIT, the equivalent code does sign-extension not zero-extension, leading to a different Datum representation of small integer data types. This inconsistency was masked in most cases, but it is known to lead to “could not find memoization table entry” errors when using Memoize plan nodes, and there might be other symptoms.

• Fix incorrect logic for caching result-relation information for triggers (David Rowley, Amit Langote) §
  In cases where partitions' column sets aren't physically identical to their parent partitioned tables' column sets, this oversight could lead to crashes.

• Add missing EvalPlanQual rechecks for TID Scan and TID Range Scan plan nodes (Sophie Alpert, David Rowley) §
  This omission led to possibly not rechecking a condition on ctid during concurrent-update situations, causing the update's behavior to vary depending on which plan type had been selected.

• Fix EvalPlanQual handling of foreign or custom joins that do not have an alternative local-join plan prepared for EPQ (Masahiko Sawada, Etsuro Fujita) §
  In such cases the foreign or custom access method should be invoked normally, but that did not happen, typically leading to a crash.

• Avoid duplicating hash partition constraints during DETACH CONCURRENTLY (Haiyang Li) §
  ALTER TABLE DETACH PARTITION CONCURRENTLY was written to add a copy of the partitioning constraint to the now-detached partition. This was misguided, partially because non-concurrent DETACH doesn't do that, but mostly because in the case of hash partitioning the constraint expression contains references to the parent table's OID. That causes problems during dump/restore, or if the parent table is dropped after DETACH. In v19 and later, we'll no longer create any such copied constraints at all. In released branches, to minimize the risk of unforeseen consequences, only skip adding a copied constraint if it is for hash partitioning.

• Disallow generated columns in partition keys (Jian He, Ashutosh Bapat) §
  This was already not allowed, but the check missed some cases, such as where the column reference is implicit in a whole-row reference.

• Disallow generated columns in COPY ... FROM ... WHERE clauses (Peter Eisentraut, Jian He) §
  Previously, incorrect behavior or an obscure error message resulted from attempting to reference such a column, since generated columns have not yet been computed at the point where WHERE filtering is done.

• Avoid potential use-after-free in parallel vacuum (Kevin Oommen Anish) §
  This bug seems to have no consequences in standard builds, but it's theoretically a hazard.

• Fix visibility checking for statistics objects in pg_temp (Noah Misch) §
  A statistics object located in a temporary schema cannot be named without schema qualification, but pg_statistics_obj_is_visible() missed that memo and could return “true” regardless. In turn, functions such as pg_describe_object() could fail to schema-qualify the object's name as expected.

• Fix pg_event_trigger_dropped_objects()'s reporting of temporary status (Antoine Violin, Tom Lane) §
  If a dropped column default, trigger, or RLS policy belongs to a temporary table, report it with is_temporary true.

• Fix memory leakage in hashed subplans (Haiyang Li) §
  Any memory consumed by the hash functions used for hashing tuples constituted a query-lifespan memory leak. One way that could happen is if the values being hashed require de-toasting.

• Avoid leaking SMgrRelation objects in the startup process (Jingtang Zhang) §
  In a long-running standby server, the hashtable holding these objects could bloat substantially, because there was no mechanism for freeing no-longer-interesting entries.

• Fix minor memory leak during WAL replay of database creation (Nathan Bossart) §

• Fix corruption of the shared statistics table after out-of-memory failures (Mikhail Kot) §
  Previously, an out-of-memory failure partway through creating a new hash table entry left a broken entry behind, potentially causing errors in other sessions later.

• Fix concurrent update issue in MERGE (Yugo Nagata) §
  When executing a MERGE UPDATE action, if there is more than one concurrent update of the target row, the lock-and-retry code would sometimes incorrectly identify the latest version of the target tuple, leading to incorrect results.

• Add missing replica identity checks in MERGE and INSERT ... ON CONFLICT DO UPDATE (Zhijie Hou) §
  If MERGE may require update or delete actions, and the target table publishes updates or deletes, insist that it have a REPLICA IDENTITY defined. Failing to require this can silently break replication. Likewise, INSERT with an UPDATE option must require REPLICA IDENTITY if the target table publishes either inserts or updates.

• Avoid deadlock during DROP SUBSCRIPTION when publisher is on the same server as subscriber (Dilip Kumar) §

• Fix incorrect reporting of replication lag in pg_stat_replication view (Fujii Masao) §
  If any standby server's replay LSN stopped advancing, the write_lag and flush_lag columns would eventually stop updating.

• Avoid duplicative log messages about invalid primary_slot_name settings (Fujii Masao) §

• Avoid failures when synchronized_standby_slots references nonexistent replication slots (Shlok Kyal) §

• Remove the unfinished slot state file after failing to write a replication slot's state to disk (Michael Paquier) §
  Previously, a failure such as out-of-disk-space resulted in leaving a temporary state.tmp file behind. That's problematic because it would block all subsequent attempts to write the state, requiring manual intervention to clean up.

• Fix mishandling of lock timeout signals in parallel apply workers for logical replication (Hayato Kuroda) §
  The same signal number was being used for both worker shutdown and lock timeout, leading to confusion.

• Avoid unwanted WAL receiver shutdown when switching from streaming to archive WAL source (Xuneng Zhou) §
  During a timeline change, a standby server's WAL receiver should remain alive, waiting for a new WAL streaming start point. Instead it was repeatedly shutting down and immediately getting restarted, which could confuse status monitoring code.

• Avoid failures in logical replication due to chance collisions of file numbers between regular and temporary tables (Vignesh C) §
  This low-probability problem manifested as transient errors like “unexpected duplicate for tablespace X, relfilenode Y”. contrib/autoprewarm was also affected. A side-effect of the fix is that the SQL function pg_filenode_relation() will now ignore temporary tables.

• Fix use-after-free issue in the relation synchronization cache maintained by the pgoutput logical decoding plugin (Vignesh C, Masahiko Sawada) §
  An error during logical decoding could result in crashes in subsequent logical decoding attempts in the same session. The case is only reachable when pgoutput is invoked via SQL functions.

• Avoid unnecessary invalidation of logical replication slots (Bertrand Drouvot) §

• Avoid assertion failure when trying to release a replication slot in single-user mode (Hayato Kuroda) §

• Fix incorrect printing of messages about failures in checking whether the user has Windows administrator privilege (Bryan Green) §
  This code would have crashed or at least printed garbage. No such cases have been reported though, indicating that failure of these system calls is extremely rare.

• Avoid startup failure on macOS and BSD platforms when there is a collision with a pre-existing semaphore set (Tom Lane) §
  If the pre-existing set has fewer semaphores than we asked for, these platforms return EINVAL not EEXIST as our code expected, resulting in failure to start the database.

• Avoid crash when attempting to test PostgreSQL with certain libsanitizer options (Emmanuel Sibi, Jacob Champion) §

• Fix false memory-context-checking warnings in debug builds on 64-bit Windows (David Rowley) §

• Correctly handle GROUP BY DISTINCT in PL/pgSQL assignment statements (Tom Lane) §
  The parser failed to record the DISTINCT option in this context, so that the command would act as if it were plain GROUP BY.

• Avoid leaking memory when handling a SQL error within PL/Python (Tom Lane) §
  This fixes a session-lifespan memory leak introduced in our previous minor releases.

• Fix libpq's trace output of characters with the high bit set (Ran Benita) §
  On platforms where char is considered signed, the output included unsightly \xffffff decoration.

• Fix libpq's handling of socket-related errors on Windows within its GSSAPI logic (Ning Wu, Tom Lane) §
  The code for encrypting/decrypting transmitted data using GSSAPI did not correctly recognize error conditions on the connection socket, since Windows reports those differently than other platforms. This led to failure to make such connections on Windows.

• Fix dumping of non-inherited not-null constraints on inherited table columns (Dilip Kumar) §
  pg_dump failed to preserve such constraints when dumping from a pre-v18 server.

• In pg_dump, dump security labels on subscriptions and event triggers (Jian He, Fujii Masao) §
  Labels on these types of objects were previously missed.

• Fix pg_dump's sorting of default ACLs and foreign key constraints (Kirill Reshke, Álvaro Herrera) §
  Ensure consistent ordering of these database object types, as was already done for other object types.

• In pg_dump, label comments for separately-dumped domain constraints with the proper dependency (Noah Misch) §
  This error could lead to parallel pg_restore attempting to create the comment before the constraint itself has been restored.

• In pg_restore, skip comments and security labels for publications and subscriptions that are not being restored (Jian He, Fujii Masao) §
  Do not emit COMMENT or SECURITY LABEL commands for these objects when --no-publications or --no-subscriptions is specified.

• Fix assorted errors in the data compression logic in pg_dump and pg_restore (Daniel Gustafsson, Tom Lane) §
  Error checking was missing or incorrect in several places, and there were also portability issues that would manifest on big-endian hardware. These problems had been missed because this code is only used to read compressed TOC files within directory-format dumps. pg_dump never produces such a dump; the case can be reached only by manually compressing the TOC file after the fact, which is a supported thing to do but very uncommon.

• Fix pgbench to error out cleanly if a COPY operation is started (Anthonin Bonnefoy) §
  pgbench doesn't intend to support this case, but previously it went into an infinite loop.

• Fix pgbench's reporting of multiple errors (Yugo Nagata) §
  In cases where two successive PQgetResult calls both fail, pgbench might report the wrong error message.

• In pgbench, fix faulty assertion about errors in pipeline mode (Yugo Nagata) §

• Fix per-file memory leakage in pg_combinebackup (Tom Lane) §

• Ensure that contrib/pg_buffercache functions can be canceled (Satyanarayana Narlapuram, Yuhang Qiu) §
  Some code paths were capable of running for a long time without checking for interrupts.

• Fix contrib/pg_prewarm's privilege checks for indexes (Ayush Vatsa, Nathan Bossart) §
  pg_prewarm() requires SELECT privilege on relations to be prewarmed. However, since indexes have no SQL privileges of their own, this resulted in non-superusers being unable to prewarm indexes. Instead, check for SELECT privilege on the index's table.

• Make contrib/pgstattuple more robust about empty or invalid index pages (Nitin Motiani) §
  Count all-zero pages as free space, and ignore pages that are invalid according to a check of the page's special-space size. The code for btree indexes already counted all-zero pages as free, but the hash and gist code would error out, which has been found to be much less user-friendly. Similarly, make all three cases agree on ignoring corrupted pages rather than throwing errors.

• Harden our read and write barrier macros to satisfy Clang (Thomas Munro) §
  We supposed that __atomic_thread_fence() is a sufficient barrier to prevent the C compiler from re-ordering memory accesses around it, but it appears that that's not true for Clang, allowing it to generate incorrect code for at least RISC-V, MIPS, and LoongArch machines. Add explicit compiler barriers to fix that.

• Fix building with LLVM version 21 and later (Holger Hoffstätte) §

• When building with meson, apply the same special optimization flags for numeric.c and checksum.c as the makefile build does (Nathan Bossart, Jeff Davis) §
  Use -ftree-vectorize for both files, as well as -funroll-loops for checksum.c, to match what the makefiles have long done.

• Fix PGXS build infrastructure to support building NLS po files for extensions (Ryo Matsumura) §

Original source