PostgreSQL patches 28 security flaws, two allow code execution
PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities.
HEISE DEVELOPER — Most let attackers run arbitrary code after a successful attack and gain full control of instances. Two high-severity CVEs involve tsvector/tsquery memory handling and the restore process. Support for PostgreSQL 14 ends November 12, 2026.
PostgreSQL's development team has released patched versions 14.24, 15.19, 16.15, 17.11 and 18.6, closing a total of 28 security vulnerabilities across the database system. Most of the flaws let attackers who successfully exploit them run arbitrary code and take full control of affected instances.
Two vulnerabilities are rated high severity. CVE-2026-14662 involves a memory handling error linked to the tsvector and tsquery data types, causing an out-of-bounds write that lets attackers write data outside the reserved memory area. CVE-2026-18408 allows code execution during a database restore operation.
The maintainers report no evidence yet that either flaw is being actively exploited. Separately, they warn that support for PostgreSQL 14 will end on November 12, 2026. After that date the branch will no longer receive security updates, so administrators still running it need to plan an upgrade to a supported version before the deadline.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.