postgresql-18 (18.6-0ubuntu0.26.04.1) resolute; urgency=medium

  Note: 18.5 was never released, due to a regression discovered post-wrap.

  A dump/restore is not required for those running 18.X.

  However, the first three security entries below describe configuration
  adjustments and data cleanups that you may need to make after updating.

  Also, if you have any GIN indexes, see the changelog entry below about
  possibly-corrupt reltuples values for their tables.

  Also, if you use contrib/btree_gist or contrib/ltree, you may need to
  reindex indexes made with those extensions; see the relevant entries
  below.

  Also, if you are upgrading from a version earlier than 18.2, see those
  release notes as well please.

  Restrict logical decoding output plugins to the set specified by a new
  server parameter output_plugin_libraries

  Previously, a replication user could select any loadable library for
  logical decoding, allowing exploits of various sorts. To allow locking
  this down without breaking setups that worked before, introduce a
  whitelist of allowed output plugins.

  By default, only the output plugins shipped as part of PostgreSQL
  (pgoutput and test_decoding) are included in output_plugin_libraries.
  Installations that rely on other output plugins must add them after
  updating the server.

  Additionally, pg_upgrade --check will fail if the
  output_plugin_libraries parameter on the new cluster does not permit the
  plugins of logical replication slots on the old cluster, when migrating
  from versions 17 and later. Make necessary additions to the new
  cluster's setting before performing pg_upgrade. (CVE-2026-6471)

  Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers

  Previously, if OpenSSL rejected the requested cipher (for example,
  because it is running in FIPS mode, or the legacy provider hasn't been
  loaded), pgcrypto failed to notice the failure and simply XOR'd the
  non-encrypted block with the plaintext, rendering the “encryption”
  trivially breakable. This will typically occur with deprecated or
  non-FIPS cipher algorithms (cipher-algo=blowfish/bf, twofish, cast5, or
  3des).

  By default, pgcrypto will now fail to decrypt any messages that were
  affected in this way. To allow retrieval of such data, a new option
  ignore-cipher-failure has been added to pgp_pub_decrypt() and
  pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their
  previous behavior, allowing the faulty encryption wrapper to be stripped
  off.

  Once the affected messages are identified and stripped of their
  wrappers, they can then be re-encrypted with a modern algorithm. It is
  important however that the behavior of OpenSSL be the same as it was
  when the faulty messages were created: if the set of unsupported
  algorithms is not the same, this approach will not work. See the
  documentation for ignore-cipher-failure. (CVE-2026-14663)

  Fix psql to skip in-line data following a scripted COPY ... FROM STDIN
  command, even if the COPY fails before sending PGRES_COPY_IN

  Previously, if a COPY command failed at startup (for instance, because
  the target table doesn't exist) psql would not realize that and would
  proceed to read the following in-line data as SQL commands. In the best
  case that's wrong and in the worst case it's a SQL-injection hazard.
  Teach psql to recognize syntactically-valid COPY ... FROM STDIN commands
  and to skip data on its own authority if the server doesn't respond with
  PGRES_COPY_IN.

  While this fix is unlikely to affect any production SQL scripts, test
  scripts might intentionally exercise failing COPY ... FROM STDIN
  commands. Those will need to gain a \. data terminator line after each
  such command. (CVE-2026-6464)

  Cross-check the output row type of a portal running EXECUTE or FETCH

  EXECUTE and FETCH use two portals: an outer one for the statement
  itself, and an inner one running the query being executed on its behalf.
  It was previously possible to make the declared row types of the two
  portals diverge, leading to server memory disclosure and arbitrary code
  execution. (CVE-2026-16239)

  Fix buffer overrun with long time zone abbreviation in to_char()

  This can easily crash the server, and exploits leading to arbitrary code
  execution have been reported. (CVE-2026-14669)

  Fix buffer overrun in regexp match/split functions

  If passed invalidly-encoded data, these functions could write past the
  end of their conversion buffer. (CVE-2026-14664)

  Harden the ascii() function against invalid input

  By supplying invalidly-encoded input, this function could be coaxed to
  read and return a few bytes of data that it shouldn't. In assert-enabled
  builds, its assertions could be triggered too. (CVE-2026-18024)

  Fix multirange type handling in pg_restore_attribute_stats()

  pg_restore_attribute_stats() treated multirange types just like their
  underlying range type. This works correctly for the bounds histogram,
  but it was wrong for all the other statistics kinds. (CVE-2026-16238)

  Make scalarineqsel() check that a constant it expects to be of type tid
  actually is

  This expectation will hold for all the built-in operators that use this
  estimator, but a maliciously-constructed operator could violate it,
  leading to a crash or server memory disclosure. (CVE-2026-14668)

  Harden tsvector and tsquery code against overly long values (both
  individual lexemes and total vector/query length)

  The documented limits were not enforced in all code paths.
  (CVE-2026-14662)

  Fix various places that mistakenly assumed they would not have to deal
  with more than FUNC_MAX_ARGS function arguments

  Notably, the server's actual limit on the number of arguments to an
  aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to
  enforce that, creating hazards downstream. (CVE-2026-14679)

  Reject calls from SQL to functions that take or return type internal

  The existing defenses against doing this have been shown to be
  insufficient, so add more explicit checks. (CVE-2026-14680)

  Preserve the ownership of extended statistics objects when they are
  rebuilt by ALTER TABLE

  Previously, the role running ALTER TABLE gained ownership of such
  objects, but that seems inappropriate. (CVE-2026-6469)

  When deparsing an EXTRACT() function call, quote the field name if
  needed

  The parser accepts any string literal as a field name in EXTRACT(),
  deferring validation to execution. If the call is stored and deparsed
  (for example during pg_dump), the string body was regurgitated verbatim,
  allowing SQL injection. (CVE-2026-15741)

  Check for USAGE privilege on data types in places that formerly failed
  to check that

  CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did
  commands that create stored expressions. These omissions allowed roles
  without USAGE privilege to nonetheless create objects depending on the
  type, possibly blocking the type's owner from changing the type later.
  (CVE-2026-6470)

  Invalidate role-dependent cached plans after role changes

  Role membership, role attribute, and database ownership changes may
  impact the expected behavior of row-level security policies, but
  previously we'd continue to use cached plans that were made according to
  the old state of affairs. (CVE-2026-14666)

  Reject GSSEncRequest after direct SSL connection

  After establishing a TLS-encrypted connection, the server would still
  accept a request for GSSAPI encryption. If that succeeded, the
  connection would proceed using TLS encryption, but it would look like a
  GSS connection to the pg_hba rules. Thus, a pg_hba policy intending to
  disallow TLS would not be enforced correctly. (CVE-2026-14681)

  Make mock SCRAM authentication secrets more plausible

  If a SCRAM login is attempted against a role that doesn't exist or
  doesn't have a SCRAM secret, we generate a mock secret and carry out the
  authentication handshake anyway, to avoid revealing these facts to an
  attacker. But the mock secret was made with a fixed iteration count,
  which in itself can be an observable response discrepancy. Use the
  configuration setting scram_iterations instead, to make the mock secret
  look more like the installation's real secrets. (CVE-2026-14672)

  Fix out-of-bounds writes in ecpg applications caused by invalid bytea
  data received from the server

  ecpg assumed without checking that any bytea value must begin with \x. A
  broken or malicious server might send a string shorter than 2 bytes,
  resulting in memory clobber in the application. (CVE-2026-16241)

  Do not do backquote expansion on the argument of psql's \unrestrict
  command

  This oversight in the fix for CVE-2025-8714 allows a malicious server to
  inject shell commands into plain-text dump output that will be run at
  restore time on the machine running psql, the exact scenario that
  CVE-2025-8714 intended to prevent. (CVE-2026-18408)

  Remove pg_dump's assumption that pg_proc.protrftypes cannot have more
  than FUNC_MAX_ARGS entries

  Since there could be entries for both input and output arguments, it's
  feasible for this array's length to exceed FUNC_MAX_ARGS (which
  constrains only input arguments). Even if that were not so, pg_dump
  cannot assume that the server was built with the same value of
  FUNC_MAX_ARGS that it has. An overrun would lead to a memory clobber
  inside pg_dump. (CVE-2026-19385)

  Harden PL/Perl against “tied” Perl arrays and hashes

  A tied object that doesn't behave like a regular one could lead to
  memory overwrite, or to constructing a corrupt result array (which would
  likely cause problems later). (CVE-2026-14670)

  Fix integer overflows in memory-allocation calculations in PL/Perl and
  PL/Tcl

  This is the same type of problem as CVE-2026-6473, just in a different
  part of the code, and is fixed in the same way. (CVE-2026-14677)

  Ensure that contrib/amcheck functions restrict search_path before
  executing index expressions

  Because amcheck will run such index expressions as the owner of their
  tables, a caller could potentially hijack search_path-dependent
  functions to run arbitrary code as the table owner. By default this is
  not a vulnerability because only superusers are allowed to call amcheck
  functions; but if that privilege was granted out, it created a larger
  hazard than the documentation suggests. (CVE-2026-14673)

  Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and
  levenshtein_less_equal() functions

  Passing large cost values to these functions could cause integer
  overflows, thereby producing nonsensical results, and even causing
  out-of-bounds writes in some cases. (CVE-2026-15742)

  Fix buffer overrun in contrib/pg_stat_statements

  Query normalization didn't accurately account for the amount of space
  the normalized string would require. (CVE-2026-14676)

  Fix datatype error in contrib/pg_trgm's GiST picksplit function

  This mistake resulted in reading past the end of the buffer, typically
  causing bad split decisions; but a crash could ensue if you're very
  unlucky. (CVE-2026-14678)

  Remove the plan cache in contrib/refint

  This caching behavior has several serious bugs, notably that
  check_foreign_key() embeds the new key values in its cascade-UPDATE
  queries, so a cached plan reuses the originally-needed values rather
  than the key values that should be used. The simplest solution is to
  remove it. (CVE-2026-14671)

  Details about these and many further changes can be found at:
  https://www.postgresql.org/docs/18/release-18-6.html.

 -- Guilherme Puida Moreira <guilherme.moreira@canonical.com>  Thu, 13 Aug 2026 16:39:00 -0300

postgresql-18 (18.4-0ubuntu0.26.04.1) resolute; urgency=medium

  A dump/restore is not required for those running 16.X.

  However, if you are upgrading from a version earlier than 18.2, see
  those release notes as well please.

  Prevent unbounded recursion while processing startup packets

  A malicious client could crash the connected backend by alternating
  rejected SSL and GSS encryption requests indefinitely. (CVE-2026-6479)

  Fix assorted integer overflows in memory-allocation calculations

  Various places were incautious about the possibility of integer overflow
  in calculations of how much memory to allocate. Overflow would lead to
  allocating a too-small buffer which the caller would then write past the
  end of. This would at least trigger server crashes, and probably could
  be exploited for arbitrary code execution. In many but by no means all
  cases, the hazard exists only in 32-bit builds. (CVE-2026-6473)

  Properly quote subscription names in pg_createsubscriber

  The given subscription name was inserted into SQL commands without
  quoting, so that SQL injection could be achieved in the (perhaps
  unlikely) case that the subscription name comes from an untrusted
  source. (CVE-2026-6476)

  Properly quote object names in logical replication origin checks

  ALTER SUBSCRIPTION ... REFRESH PUBLICATION interpolated schema and
  relation names into SQL commands without quoting them, allowing
  execution of arbitrary SQL on the publisher. (CVE-2026-6638)

  Reject over-length options in ts_headline()

  The StartSel, StopSel and FragmentDelimiter strings must not exceed 32Kb
  in length, but this was not checked for. An over-length value would
  typically crash the server. (CVE-2026-6473)

  Detect faulty input when restoring attribute MCV statistics

  The statistics restore functions were insufficiently careful about
  validating most-common-value statistics, and would accept values that
  could crash the planner later on. (CVE-2026-6575)

  Guard against malicious time zone names in timeofday() and pg_strftime()

  A crafted time zone setting could pass % sequences to snprintf(),
  potentially causing crashes or disclosure of server memory. Another path
  to similar results was to overflow the limited-size output buffer used
  by pg_strftime(). (CVE-2026-6474)

  When creating a multirange type, ensure the user has CREATE privilege on
  the schema specified for the multirange type

  The multirange type can be put into a different schema than its parent
  range type, but we neglected to apply the required privilege check when
  doing so. (CVE-2026-6472)

  Use timing-safe string comparisons in authentication code

  Use timingsafe_bcmp() instead of memcpy() or strcmp() when checking
  passwords, hashes, etc. It is not known whether the data dependency of
  those functions is usefully exploitable in any of these places, but in
  the interests of safety, replace them. (CVE-2026-6478)

  Mark PQfn() as unsafe, and avoid using it within libpq

  For a non-integral result type, PQfn() is not passed the size of the
  output buffer, so it cannot check that the data returned by the server
  will fit. A malicious server could therefore overwrite client memory.
  This is unfixable without an API change, so mark the function as
  deprecated. Internally to libpq, use a variant version that can apply
  the missing check. (CVE-2026-6477)

  Prevent path traversal in pg_basebackup and pg_rewind

  These applications failed to validate output file paths read from their
  input, so that a malicious source could overwrite any file writable by
  these applications. Constrain where data can be written by rejecting
  paths that are absolute or contain parent-directory references.
  (CVE-2026-6475)

  Guard against field overflow within contrib/intarray's query_int type
  and contrib/ltree's ltxtquery type

  Parsing of these query structures did not check for overflow of 16-bit
  fields, so that construction of an invalid query tree was possible. This
  can crash the server when executing the query. (CVE-2026-6473)

  Guard against overly long values of contrib/ltree's lquery type

  Values with more than 64K items caused internal overflows, potentially
  resulting in stack smashes or wrong answers. (CVE-2026-6473)

  Prevent SQL injection and buffer overruns in contrib/spi

  check_foreign_key() was insufficiently careful about quoting key values,
  and also used fixed-length buffers for constructing queries. While this
  module is only meant as example code, it still shouldn't contain such
  dangerous errors. (CVE-2026-6637)

  Details about these and many further changes can be found at:
  https://www.postgresql.org/docs/18/release-18-4.html.

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 15 May 2026 06:49:08 -0300
