{"already_in_source_count":0,"candidate_count":5,"cross_major":false,"cve_available":true,"cve_count":1,"cves":[{"affected":{"14":"14","15":"15","16":"16","17":"17","18":"18"},"affected_ranges":[{"from":"0","until":"14.21"},{"from":"15","until":"15.16"},{"from":"16","until":"16.12"},{"from":"17","until":"17.8"},{"from":"18","until":"18.2"}],"cna_url":"https://cveawg.mitre.org/api/cve/CVE-2026-2006","component":"core server","cvss_version":"3.0","description_en":"Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.","first_published":"2026-02-12","fixed":{"14":"14.21","15":"15.16","16":"16.12","17":"17.8","18":"18.2"},"fixed_version":"14.21","id":"CVE-2026-2006","introduced":{},"published":{"14":"2026-02-12","15":"2026-02-12","16":"2026-02-12","17":"2026-02-12","18":"2026-02-12"},"score":8.8,"title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","url":"https://www.postgresql.org/support/security/CVE-2026-2006/","vector":"AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"duplicate_count":0,"excluded_count":0,"exclusions":[],"from_release":null,"groups":[{"age_days":259,"build":"14.22","changes_count":5,"compatibility_count":0,"content_hash":"5027bfe4b3e0ece6b5f26d3ebd82eba90f714efa24face7db6e0d4488f23f8af","date":"2026-02-26","date_text":"2026-02-26","doc_git":"","doc_loaded_at":"2026-09-25T02:22:44.760693","entries":[{"also_in":[],"category":"bugfix","category_label":"Bug fixes","commit_aliases":["23064542f","4a36c89f1","547a8aaa7","817f74600","899de38d8"],"commit_groups":[["23064542f","4a36c89f1","547a8aaa7","817f74600","899de38d8"]],"commits":["547a8aaa7"],"cves":[],"db_id":"bb4c9dfad3173d99906963ab569e5990","html":"\u003cp\u003eFix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas) \u003ca href=\"https://postgr.es/c/547a8aaa7\"\u003e§\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eErroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like \u003cspan\u003e“\u003cspan\u003ecould not access status of transaction\u003c/span\u003e”\u003c/span\u003e. A typical scenario in which this could occur is a standby server of the latest minor version consuming WAL from a primary server of an older version.\u003c/p\u003e","id":"14.22-006d7b5e05d070c9","identity_text":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas) Erroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like could not access status of transaction. A typical scenario in which this could occur is a standby server of the latest minor version consuming WAL from a primary server of an older version.","part":"changes","patch_ids":["e8c592597fe0c522a838714ea94d192e"],"related_changes":[{"db_id":"6d7df9238b789e2555fe1290d455a61a","evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"kind":"equivalent","label":"18.3","source_url":"/docs/release/18.3/#RELEASE-18-3-CHANGES","title":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version","url":"/docs/compare/?release=18.3#18.3-ad611cd1e209983f","version":"18.3"},{"db_id":"269e20cac41b248d80f469e35fb3be04","evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"kind":"equivalent","label":"17.9","source_url":"/docs/release/17.9/#RELEASE-17-9-CHANGES","title":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version","url":"/docs/compare/?release=17.9#17.9-80ecbcad5117683e","version":"17.9"},{"db_id":"54acee06ad9ee6f00cba048e48dfdadc","evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"kind":"equivalent","label":"16.13","source_url":"/docs/release/16.13/#RELEASE-16-13-CHANGES","title":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version","url":"/docs/compare/?release=16.13#16.13-2ec40dc78a340503","version":"16.13"},{"db_id":"ac9d069b97f39c99f4c9540523c6dd01","evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"kind":"equivalent","label":"15.17","source_url":"/docs/release/15.17/#id-1.11.6.8.5","title":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version","url":"/docs/compare/?release=15.17#15.17-b825392cb651a3f2","version":"15.17"}],"relations":[{"evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"rule":2,"target":"269e20cac41b248d80f469e35fb3be04","type":"equivalent"},{"evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"rule":2,"target":"54acee06ad9ee6f00cba048e48dfdadc","type":"equivalent"},{"evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"rule":2,"target":"6d7df9238b789e2555fe1290d455a61a","type":"equivalent"},{"evidence":{"patch_ids":["e8c592597fe0c522a838714ea94d192e"],"same_day":true,"statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d"},"rule":2,"target":"ac9d069b97f39c99f4c9540523c6dd01","type":"equivalent"}],"section":"Changes","section_path":["Changes"],"source_commits":["547a8aaa7"],"source_entry_id":"14.22/changes/001","source_hash":"9212074eaa68a0624b60a2716531a84f7225793a697c4e3f1126a04727c96a52","source_url":"/docs/release/14.22/#id-1.11.6.8.6","statement_hash":"cf611d327c6efbb05b8c3c3eec25baadc4b81f3015eda12031c5dfd70647d75d","text":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas) § Erroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like “could not access status of transaction”. A typical scenario in which this could occur is a standby server of the latest minor version consuming WAL from a primary server of an older version.","title":"Fix failure after replaying a multixid truncation record from WAL that was generated by an older minor version","variants":[],"version":"14.22"},{"also_in":[],"category":"security","category_label":"Security","commit_aliases":["14b1fd617","2280ab354","4174e41b9","44fc85bbf","45eb47230","4644f8b23","50d361f62","5b305ebcc","5d5232bc3","6e045e1a6","8cef93d8a","8e73530f1","9f4fd119b","a0769e74d","a20eb248c","bdfb37228","d04b34d68","ec86152e0"],"commit_groups":[["14b1fd617","5d5232bc3","6e045e1a6","9f4fd119b","a20eb248c","bdfb37228"],["2280ab354","50d361f62","8cef93d8a","a0769e74d","d04b34d68","ec86152e0"],["4174e41b9","44fc85bbf","45eb47230","4644f8b23","5b305ebcc","8e73530f1"]],"commits":["14b1fd617","44fc85bbf","a0769e74d"],"cves":["CVE-2026-2006"],"db_id":"da9fc04e8b825c72955bd70be9fd53ee","html":"\u003cp\u003eAvoid incorrect complaint of invalid encoding when \u003ccode\u003esubstring()\u003c/code\u003e is applied to \u003cspan\u003e“\u003cspan\u003etoasted\u003c/span\u003e”\u003c/span\u003e data (Noah Misch) \u003ca href=\"https://postgr.es/c/14b1fd617\"\u003e§\u003c/a\u003e \u003ca href=\"https://postgr.es/c/a0769e74d\"\u003e§\u003c/a\u003e \u003ca href=\"https://postgr.es/c/44fc85bbf\"\u003e§\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThe fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.\u003c/p\u003e","id":"14.22-0e619c964c972dcb","identity_text":"Avoid incorrect complaint of invalid encoding when substring() is applied to toasted data (Noah Misch) The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.","part":"changes","patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"related_changes":[{"db_id":"9b63cad6030353d772f1330dfd687e9f","evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"kind":"equivalent","label":"18.3","source_url":"/docs/release/18.3/#RELEASE-18-3-CHANGES","title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","url":"/docs/compare/?release=18.3#18.3-77113f5b52409590","version":"18.3"},{"db_id":"91516991913d971894a1428891e4772e","evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"kind":"equivalent","label":"17.9","source_url":"/docs/release/17.9/#RELEASE-17-9-CHANGES","title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","url":"/docs/compare/?release=17.9#17.9-24d7e69f6ec0ae9a","version":"17.9"},{"db_id":"fe28a154c085da9085a635db8d9d4460","evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"kind":"equivalent","label":"16.13","source_url":"/docs/release/16.13/#RELEASE-16-13-CHANGES","title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","url":"/docs/compare/?release=16.13#16.13-46657f359d7a6c06","version":"16.13"},{"db_id":"2913b28e99dd666bc31951814a799735","evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"kind":"equivalent","label":"15.17","source_url":"/docs/release/15.17/#id-1.11.6.8.5","title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","url":"/docs/compare/?release=15.17#15.17-ed7a109835c41923","version":"15.17"}],"relations":[{"evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"rule":2,"target":"2913b28e99dd666bc31951814a799735","type":"equivalent"},{"evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"rule":2,"target":"91516991913d971894a1428891e4772e","type":"equivalent"},{"evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"rule":2,"target":"9b63cad6030353d772f1330dfd687e9f","type":"equivalent"},{"evidence":{"patch_ids":["924bc2a7b62c922890c6948fec9b1504","b621552d0483c3fe9118c60e77f297ab","fe6380c6909ab3efff6be8983b7f18a1"],"same_day":true,"statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747"},"rule":2,"target":"fe28a154c085da9085a635db8d9d4460","type":"equivalent"}],"section":"Changes","section_path":["Changes"],"source_commits":["14b1fd617","44fc85bbf","a0769e74d"],"source_entry_id":"14.22/changes/002","source_hash":"8aab71de2df78e8accda8ef64c309861de6948b07e76e1dbbbbf799536959026","source_url":"/docs/release/14.22/#id-1.11.6.8.6","statement_hash":"b34aae4222592f29a7ecee54df249e73bebb9346d81b2e5c859347ba8c1ea747","text":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data (Noah Misch) § § § The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.","title":"Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data","variants":[],"version":"14.22"},{"also_in":[],"category":"bugfix","category_label":"Bug fixes","commit_aliases":["2332911ae","53463b4b2","78a5e3074","82b495cdd","842473337","ebc53ca7b"],"commit_groups":[["2332911ae","53463b4b2","78a5e3074","82b495cdd","842473337","ebc53ca7b"]],"commits":["82b495cdd"],"cves":[],"db_id":"b1227a7b977e0fdde28e2260fd4055ca","html":"\u003cp\u003eFix \u003ccode\u003epg_stat_get_backend_wait_event()\u003c/code\u003e and \u003ccode\u003epg_stat_get_backend_wait_event_type()\u003c/code\u003e to report values for auxiliary processes (Heikki Linnakangas) \u003ca href=\"https://postgr.es/c/82b495cdd\"\u003e§\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003ePreviously these functions returned NULL for auxiliary processes, but that's inconsistent with the \u003ccode\u003epg_stat_activity\u003c/code\u003e view.\u003c/p\u003e","id":"14.22-380d81041c2b7b37","identity_text":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes (Heikki Linnakangas) Previously these functions returned NULL for auxiliary processes, but that's inconsistent with the pg_stat_activity view.","part":"changes","patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"related_changes":[{"db_id":"51c535e1e5383ba40f60f95b951f7542","evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"kind":"equivalent","label":"18.3","source_url":"/docs/release/18.3/#RELEASE-18-3-CHANGES","title":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes","url":"/docs/compare/?release=18.3#18.3-a63ceb8e607a4b1d","version":"18.3"},{"db_id":"ca6d569bfd12f83cd8b663f7b1b14c38","evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"kind":"equivalent","label":"17.9","source_url":"/docs/release/17.9/#RELEASE-17-9-CHANGES","title":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes","url":"/docs/compare/?release=17.9#17.9-49611ef76ca99838","version":"17.9"},{"db_id":"0fa32f0f7fbb9d8c7a7a1cfeaa993230","evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"kind":"equivalent","label":"16.13","source_url":"/docs/release/16.13/#RELEASE-16-13-CHANGES","title":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes","url":"/docs/compare/?release=16.13#16.13-ba7ab6fc9d199173","version":"16.13"},{"db_id":"d389f553498aab12a33e8658e42c2ebd","evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"kind":"equivalent","label":"15.17","source_url":"/docs/release/15.17/#id-1.11.6.8.5","title":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes","url":"/docs/compare/?release=15.17#15.17-004af2947054d2ea","version":"15.17"}],"relations":[{"evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"rule":2,"target":"0fa32f0f7fbb9d8c7a7a1cfeaa993230","type":"equivalent"},{"evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"rule":2,"target":"51c535e1e5383ba40f60f95b951f7542","type":"equivalent"},{"evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"rule":2,"target":"ca6d569bfd12f83cd8b663f7b1b14c38","type":"equivalent"},{"evidence":{"patch_ids":["54586dcff5ba8f38c9bad3069e4ffc52"],"same_day":true,"statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90"},"rule":2,"target":"d389f553498aab12a33e8658e42c2ebd","type":"equivalent"}],"section":"Changes","section_path":["Changes"],"source_commits":["82b495cdd"],"source_entry_id":"14.22/changes/003","source_hash":"e7d0d9d50b3eeed6849bef3c43485e68131ca02ac541e610cb56510c8af284c7","source_url":"/docs/release/14.22/#id-1.11.6.8.6","statement_hash":"f5b50524b8ec05ef6a3e7bcc10dc01af6ebe577734eff3be2cb39b4262840b90","text":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes (Heikki Linnakangas) § Previously these functions returned NULL for auxiliary processes, but that's inconsistent with the pg_stat_activity view.","title":"Fix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes","variants":[],"version":"14.22"},{"also_in":[],"category":"bugfix","category_label":"Bug fixes","commit_aliases":["254b15cbf","2b93d3820","9863c9075","c66f4cff1","ce4b7e3a1","dfd850980"],"commit_groups":[["254b15cbf","2b93d3820","9863c9075","c66f4cff1","ce4b7e3a1","dfd850980"]],"commits":["2b93d3820"],"cves":[],"db_id":"08e9766e078b0f98d664963d7351568a","html":"\u003cp\u003eFix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane) \u003ca href=\"https://postgr.es/c/2b93d3820\"\u003e§\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eIf the variable's value is NULL, a \u003cspan\u003e“\u003cspan\u003ecache lookup failed for type 0\u003c/span\u003e”\u003c/span\u003e error resulted.\u003c/p\u003e","id":"14.22-3b6651931176e1ab","identity_text":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane) If the variable's value is NULL, a cache lookup failed for type 0 error resulted.","part":"changes","patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"related_changes":[{"db_id":"d7289871637eb477a52d704b8b129dee","evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"kind":"equivalent","label":"18.3","source_url":"/docs/release/18.3/#RELEASE-18-3-CHANGES","title":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function","url":"/docs/compare/?release=18.3#18.3-68534f113dfbb27d","version":"18.3"},{"db_id":"1f6375c5be0406ebaeab1ddd1281f48a","evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"kind":"equivalent","label":"17.9","source_url":"/docs/release/17.9/#RELEASE-17-9-CHANGES","title":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function","url":"/docs/compare/?release=17.9#17.9-00f1ed550848c3b5","version":"17.9"},{"db_id":"b3e55b2d8440115c6283ddb4434aed5d","evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"kind":"equivalent","label":"16.13","source_url":"/docs/release/16.13/#RELEASE-16-13-CHANGES","title":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function","url":"/docs/compare/?release=16.13#16.13-63ccf52c03df56be","version":"16.13"},{"db_id":"509c9d18c03750ab5a1af4533e9e3f71","evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"kind":"equivalent","label":"15.17","source_url":"/docs/release/15.17/#id-1.11.6.8.5","title":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function","url":"/docs/compare/?release=15.17#15.17-f14d3ac393cef450","version":"15.17"}],"relations":[{"evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"rule":2,"target":"1f6375c5be0406ebaeab1ddd1281f48a","type":"equivalent"},{"evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"rule":2,"target":"509c9d18c03750ab5a1af4533e9e3f71","type":"equivalent"},{"evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"rule":2,"target":"b3e55b2d8440115c6283ddb4434aed5d","type":"equivalent"},{"evidence":{"patch_ids":["4682bfcc99694f6b7bf7c07af3082c2e"],"same_day":true,"statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5"},"rule":2,"target":"d7289871637eb477a52d704b8b129dee","type":"equivalent"}],"section":"Changes","section_path":["Changes"],"source_commits":["2b93d3820"],"source_entry_id":"14.22/changes/004","source_hash":"a603228f78f7eefdc96b1d1e361e2a16b88237d46c78d95c8bfeaa638e207bda","source_url":"/docs/release/14.22/#id-1.11.6.8.6","statement_hash":"257a19cad310234769985e6594cf9f32698b7849a63b72427ee23e58e321e7d5","text":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane) § If the variable's value is NULL, a “cache lookup failed for type 0” error resulted.","title":"Fix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function","variants":[],"version":"14.22"},{"also_in":[],"category":"bugfix","category_label":"Bug fixes","commit_aliases":["0dfbe42da","31d0b917d","4a0843c53","63c05e03b","a6f823e77","f604cc695"],"commit_groups":[["0dfbe42da","31d0b917d","4a0843c53","63c05e03b","a6f823e77","f604cc695"]],"commits":["f604cc695"],"cves":[],"db_id":"333c171c538037b7ded4bd4a610b1799","html":"\u003cp\u003eFix potential null pointer dereference in \u003ccode\u003econtrib/hstore\u003c/code\u003e's binary input function (Michael Paquier) \u003ca href=\"https://postgr.es/c/f604cc695\"\u003e§\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003ehstore\u003c/code\u003e's receive function crashed on input containing duplicate keys. \u003ccode\u003ehstore\u003c/code\u003e values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be provoked by malicious or corrupted data.\u003c/p\u003e","id":"14.22-e6357c39af22cdb6","identity_text":"Fix potential null pointer dereference in contrib/hstore's binary input function (Michael Paquier) hstore's receive function crashed on input containing duplicate keys. hstore values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be provoked by malicious or corrupted data.","part":"changes","patch_ids":["05e85f727ef4e88378a37028157d43b6"],"related_changes":[{"db_id":"302f35b8c992f59981d9c8bbcbf80b74","evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"kind":"equivalent","label":"18.3","source_url":"/docs/release/18.3/#RELEASE-18-3-CHANGES","title":"Fix potential null pointer dereference in contrib/hstore's binary input function","url":"/docs/compare/?release=18.3#18.3-72cba4c8d34e077e","version":"18.3"},{"db_id":"3a65408ffac19ce6c90d333d8d5318cf","evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"kind":"equivalent","label":"17.9","source_url":"/docs/release/17.9/#RELEASE-17-9-CHANGES","title":"Fix potential null pointer dereference in contrib/hstore's binary input function","url":"/docs/compare/?release=17.9#17.9-09236fba7643dbb2","version":"17.9"},{"db_id":"6c2d1768700fe19270f371e13fa79343","evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"kind":"equivalent","label":"16.13","source_url":"/docs/release/16.13/#RELEASE-16-13-CHANGES","title":"Fix potential null pointer dereference in contrib/hstore's binary input function","url":"/docs/compare/?release=16.13#16.13-cbdd4e244cbf6bcb","version":"16.13"},{"db_id":"88acf3ddcff5993038ed18e0a7157844","evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"kind":"equivalent","label":"15.17","source_url":"/docs/release/15.17/#id-1.11.6.8.5","title":"Fix potential null pointer dereference in contrib/hstore's binary input function","url":"/docs/compare/?release=15.17#15.17-cf5bd5f4632c2dc1","version":"15.17"}],"relations":[{"evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"rule":2,"target":"302f35b8c992f59981d9c8bbcbf80b74","type":"equivalent"},{"evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"rule":2,"target":"3a65408ffac19ce6c90d333d8d5318cf","type":"equivalent"},{"evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"rule":2,"target":"6c2d1768700fe19270f371e13fa79343","type":"equivalent"},{"evidence":{"patch_ids":["05e85f727ef4e88378a37028157d43b6"],"same_day":true,"statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d"},"rule":2,"target":"88acf3ddcff5993038ed18e0a7157844","type":"equivalent"}],"section":"Changes","section_path":["Changes"],"source_commits":["f604cc695"],"source_entry_id":"14.22/changes/005","source_hash":"1e770afe101e4c1b1bd76f355554802881e3b488ea36e5a267f0b8105dd6c1e3","source_url":"/docs/release/14.22/#id-1.11.6.8.6","statement_hash":"d3475d54feed07f63eac9d89bc0052bdf62514368b9675dd5fa3bbf2749ab52d","text":"Fix potential null pointer dereference in contrib/hstore's binary input function (Michael Paquier) § hstore's receive function crashed on input containing duplicate keys. hstore values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be provoked by malicious or corrupted data.","title":"Fix potential null pointer dereference in contrib/hstore's binary input function","variants":[],"version":"14.22"}],"entry_count":5,"eol":"2026-11-12","eol_date":"2026-11-12","label":"14.22","major":"14","manual":"14","manual_build":"14.24","manual_url":"/docs/14/release-14-22.html","migration_html":"\u003cp\u003eA dump/restore is not required for those running 14.X.\u003c/p\u003e\n\u003cp\u003eHowever, if you are upgrading from a version earlier than 14.19, see \u003ca href=\"/docs/14/release-14-19.html\" title=\"E.6. Release 14.19\"\u003eSection E.6\u003c/a\u003e.\u003c/p\u003e","minor":22,"placeholder":false,"source_as_of":"","source_url":"/docs/release/14.22/","status":"stable","status_label":"Supported","support_days":0,"supported":true,"version":"14.22"}],"mode":"release","release_count":1,"remaining_cves":[],"security_as_of":"2026-09-26","security_regressions":[],"source_as_of":"2026-09-26","stats":[{"count":5,"key":"all","label":"All changes"},{"count":0,"key":"feature","label":"Features"},{"count":4,"key":"bugfix","label":"Bug fixes"},{"count":1,"key":"security","label":"Security"},{"count":0,"key":"performance","label":"Performance"},{"count":0,"key":"compatibility","label":"Compatibility"},{"count":0,"key":"improvement","label":"Improvements"}],"to_release":{"age_days":259,"build":"14.22","changes_count":5,"compatibility_count":0,"content_hash":"5027bfe4b3e0ece6b5f26d3ebd82eba90f714efa24face7db6e0d4488f23f8af","date":"2026-02-26","date_text":"2026-02-26","doc_git":"","doc_loaded_at":"2026-09-25T02:22:44.760693","entry_count":5,"eol":"2026-11-12","eol_date":"2026-11-12","label":"14.22","major":"14","manual":"14","manual_build":"14.24","manual_url":"/docs/14/release-14-22.html","migration_html":"\u003cp\u003eA dump/restore is not required for those running 14.X.\u003c/p\u003e\n\u003cp\u003eHowever, if you are upgrading from a version earlier than 14.19, see \u003ca href=\"/docs/14/release-14-19.html\" title=\"E.6. Release 14.19\"\u003eSection E.6\u003c/a\u003e.\u003c/p\u003e","minor":22,"placeholder":false,"source_as_of":"","source_url":"/docs/release/14.22/","status":"stable","status_label":"Supported","support_days":0,"supported":true,"version":"14.22"},"total":5,"warnings":[]}