PostgreSQL closes 28 security holes in a coordinated release across five versions

PostgreSQL shipped 18.6, 17.11, 16.15, 15.19, and 14.24 together on August 13, closing 28 CVEs and over 110 bugs in one coordinated release. Several fixes carry CVSS scores above 8, including heap buffer overflows in pg_dump, pg_stat_statements, and regex handling that allow arbitrary code execution, plus a logical-decoding bug that could let an attacker dlopen an arbitrary file. Anyone running Postgres in production, self-hosted or on a managed service like RDS or Aurora, should patch promptly rather than wait for a routine maintenance window. The release also flags three post-update chores: tables with GIN indexes may need an ANALYZE, and btree_gist or ltree indexes on affected column types may need a REINDEX. Separately, PostgreSQL 19 Beta 3 landed with a unified REPACK command and refined temporal-table syntax, and the project reiterated that PostgreSQL 14 stops receiving fixes on November 12 — teams still on 14 should start planning the upgrade now.

This is a summary by our content curator. Read the original at PostgreSQL: https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/.