PostgreSQL 14.24, 15.19, 16.15, 17.11, and 18.6 Released with Major Security Fixes

The PostgreSQL Project released version 14.24 on August 13, 2026, along with coordinated releases of 15.19, 16.15, 17.11, and 18.6 Beta 3. These maintenance releases address significant security issues and functional defects across the database system.

Security highlights include a new server parameter output_plugin_libraries that restricts logical decoding output plugins to a whitelist, preventing unprivileged replication users from loading arbitrary libraries. The default allows only built-in pgoutput and test_decoding plugins; administrators must update this setting if custom plugins are in use.

A critical flaw in contrib/pgcrypto's PGP encryption was fixed where OpenSSL cipher rejections (due to FIPS mode or missing providers) went undetected, causing silently broken encryption using XOR operations on plaintext. A new ignore-cipher-failure option allows affected data to be recovered before re-encryption. Deprecated ciphers (blowfish, twofish, cast5, 3des) are most affected.

Multiple buffer overrun vulnerabilities were patched: to_char() with long timezone abbreviations, regexp match/split functions with invalid encoding, and pg_stat_statements query normalization. A buffer overrun in to_char() easily crashes the server; fixes were reported by security researchers from AntAISecurityLab, OpenAI, and others.

Privilege checking gaps were closed in CREATE TYPE AS RANGE, ALTER TABLE OF, and stored expression creation—these commands no longer allow users without USAGE privilege on data types to create dependent objects. GSSEncRequest is now rejected after TLS connection establishment to prevent pg_hba policy circumvention.

SQL injection risks were eliminated: EXTRACT() function calls are now properly quoted when deparsed during operations like pg_dump, and psql's \unrestrict command no longer expands backquotes in input, closing a hole introduced in the CVE-2025-8714 fix.

Portal row-type mismatches in EXECUTE/FETCH could enable server memory disclosure and code execution; cross-checks now prevent this. The scalarineqsel() planner estimator now validates that tid-type constants are genuine. Role-dependent cached plans are invalidated after membership, attribute, or ownership changes to prevent row-level security bypass.

Additional fixes address tsvector/tsquery length limits, function argument count validation, internal-type function calls, extended statistics ownership during ALTER TABLE, and ecpg bytea handling. PL/Perl and PL/Tcl received hardening against tied objects and integer overflows in memory calculations.

Contrib module fixes include amcheck search_path restriction, fuzzystrmatch integer overflow in levenshtein functions, pg_trgm GiST buffer overrun, btree_gist NaN handling and not-equal operator searches, and ltree integer overflow in comparisons. The refint module's defective plan cache was removed.

Build support was added for Visual Studio 2026 and OpenSSL 4. Timezone data was updated to tzdata 2026c, reflecting Alberta's permanent UTC-06 from November 2026 and Morocco's shift to permanent UTC+00 on September 20, 2026.

The PostgreSQL community will cease updates for version 14.X in November 2026. For version 14 users, no dump/restore is required, but configuration adjustments and data cleanup may be necessary—details appear in the official release notes.