A dump/restore is not required for those running 16.X.
\nHowever, the first three security entries below describe configuration adjustments and data cleanups that you may need to make after updating.
\nAlso, if you use contrib/btree_gist or contrib/ltree, you may need to reindex indexes made with those extensions; see the relevant entries below.
Also, if you are upgrading from a version earlier than 16.10, see Section E.6.
", "compatibility_count": 0, "label": "16.15", "status_label": "Supported", "eol": "2028-11-09", "age_days": 44, "support_days": 775}, "groups": [{"date": "2026-08-13", "build": "16.15", "major": "16", "minor": 15, "manual": "16", "status": "stable", "doc_git": "", "version": "16.15", "eol_date": "2028-11-09", "date_text": "2026-08-13", "supported": true, "manual_url": "/docs/16/release-16-15.html", "source_url": "/docs/release/16.15/", "entry_count": 98, "placeholder": false, "content_hash": "666f5271705337af4892724aada7d802608b91fcc729aa4bf41b32fa7c1cec19", "manual_build": "16.15", "source_as_of": "", "changes_count": 98, "doc_loaded_at": "2026-09-25T02:22:44.760693", "migration_html": "A dump/restore is not required for those running 16.X.
\nHowever, the first three security entries below describe configuration adjustments and data cleanups that you may need to make after updating.
\nAlso, if you use contrib/btree_gist or contrib/ltree, you may need to reindex indexes made with those extensions; see the relevant entries below.
Also, if you are upgrading from a version earlier than 16.10, see Section E.6.
", "compatibility_count": 0, "label": "16.15", "status_label": "Supported", "eol": "2028-11-09", "age_days": 44, "support_days": 775, "entries": [{"id": "16.15-d023ef134eea5c3e", "cves": ["CVE-2026-6471"], "html": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries (Jacob Champion) §
Previously, a replication user could select any loadable library for logical decoding, allowing exploits of various sorts. To allow locking this down without breaking setups that worked before, introduce a whitelist of allowed output plugins.
\nBy default, only the output plugins shipped as part of PostgreSQL (pgoutput and test_decoding) are included in output_plugin_libraries. Installations that rely on other output plugins must add them after updating the server, for example
output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder'\n\n
Additionally, pg_upgrade --check will fail if the output_plugin_libraries parameter on the new cluster does not permit the plugins of logical replication slots on the old cluster, when migrating from versions 17 and later. Make necessary additions to the new cluster's setting before performing pg_upgrade.
The PostgreSQL Project thanks Vladimir Tokarev and Yu Kunpeng for reporting this problem. (CVE-2026-6471)
", "text": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries (Jacob Champion) § Previously, a replication user could select any loadable library for logical decoding, allowing exploits of various sorts. To allow locking this down without breaking setups that worked before, introduce a whitelist of allowed output plugins. By default, only the output plugins shipped as part of PostgreSQL (pgoutput and test_decoding) are included in output_plugin_libraries. Installations that rely on other output plugins must add them after updating the server, for example output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder' Additionally, pg_upgrade --check will fail if the output_plugin_libraries parameter on the new cluster does not permit the plugins of logical replication slots on the old cluster, when migrating from versions 17 and later. Make necessary additions to the new cluster's setting before performing pg_upgrade. The PostgreSQL Project thanks Vladimir Tokarev and Yu Kunpeng for reporting this problem. (CVE-2026-6471)", "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "commits": ["4e1252ee5"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "478a3978b1cac045ce55546e88778cea570f27b639cd8ef471a72f129cdb60b8", "section_path": ["Changes"], "commit_groups": [["01992176e", "226e49cbe", "2a29b607d", "4e1252ee5", "5d47df21e", "99f205407", "bf3842a64"], ["20e9dcefd", "4fcccea97", "7082ce248", "82fd68801"]], "identity_text": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries (Jacob Champion) Previously, a replication user could select any loadable library for logical decoding, allowing exploits of various sorts. To allow locking this down without breaking setups that worked before, introduce a whitelist of allowed output plugins. By default, only the output plugins shipped as part of PostgreSQL (pgoutput and test_decoding) are included in output_plugin_libraries. Installations that rely on other output plugins must add them after updating the server, for example output_plugin_libraries = 'pgoutput, test_decoding, my_trusted_decoder' Additionally, pg_upgrade --check will fail if the output_plugin_libraries parameter on the new cluster does not permit the plugins of logical replication slots on the old cluster, when migrating from versions 17 and later. Make necessary additions to the new cluster's setting before performing pg_upgrade. The PostgreSQL Project thanks Vladimir Tokarev and Yu Kunpeng for reporting this problem. (CVE-2026-6471)", "commit_aliases": ["01992176e", "20e9dcefd", "226e49cbe", "2a29b607d", "4e1252ee5", "4fcccea97", "5d47df21e", "7082ce248", "82fd68801", "99f205407", "bf3842a64"], "source_commits": ["20e9dcefd", "4e1252ee5"], "source_entry_id": "16.15/changes/001", "db_id": "b5e7e2e2c6e0c744c28da7990822970a", "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212", "relations": [{"rule": 2, "type": "equivalent", "target": "2ed41f6adf451dd977da156f72190023", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}}, {"rule": 2, "type": "equivalent", "target": "549fb97375289bbc21d70209d1e5e9a8", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}}, {"rule": 2, "type": "equivalent", "target": "7007806ed1d8192364b7ef102e45e7ef", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}}, {"rule": 2, "type": "equivalent", "target": "bbf53e61656864929954589e1f777019", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "2ed41f6adf451dd977da156f72190023", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}, "url": "/docs/compare/?release=18.6#18.6-76e8d95ade6e17d6", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "549fb97375289bbc21d70209d1e5e9a8", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}, "url": "/docs/compare/?release=17.11#17.11-ccab0c809e14d029", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "7007806ed1d8192364b7ef102e45e7ef", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}, "url": "/docs/compare/?release=15.19#15.19-b1dbeb58e5a6c437", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "bbf53e61656864929954589e1f777019", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "evidence": {"same_day": true, "patch_ids": ["29a8e1db1536ed40c71312e7d2015c9e", "bcbaedd0455bfc84b87ba56b7f4aba2c"], "statement_hash": "66cffd63e622afc809ffcea154c77acb7025871176da7689b08b6db15ff40212"}, "url": "/docs/compare/?release=14.24#14.24-ee721afe6731e1ce", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-8ceb116fc33c62af", "cves": ["CVE-2026-14663"], "html": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers (Daniel Gustafsson) § §
Previously, if OpenSSL rejected the requested cipher (for example, because it is running in FIPS mode, or the legacy provider hasn't been loaded), pgcrypto failed to notice the failure and simply XOR'd the non-encrypted block with the plaintext, rendering the “encryption” trivially breakable. This will typically occur with deprecated or non-FIPS cipher algorithms (cipher-algo=blowfish/bf, twofish, cast5, or 3des).
\nBy default, pgcrypto will now fail to decrypt any messages that were affected in this way. To allow retrieval of such data, a new option ignore-cipher-failure has been added to pgp_pub_decrypt() and pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their previous behavior, allowing the faulty encryption wrapper to be stripped off:
pgp_sym_decrypt(encrypted_column, any key, 'ignore-cipher-failure=1')\n\nOnce the affected messages are identified and stripped of their wrappers, they can then be re-encrypted with a modern algorithm. It is important however that the behavior of OpenSSL be the same as it was when the faulty messages were created: if the set of unsupported algorithms is not the same, this approach will not work. See the documentation for ignore-cipher-failure.
The PostgreSQL Project thanks Shishir Sharma for reporting this problem. (CVE-2026-14663)
", "text": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers (Daniel Gustafsson) § § Previously, if OpenSSL rejected the requested cipher (for example, because it is running in FIPS mode, or the legacy provider hasn't been loaded), pgcrypto failed to notice the failure and simply XOR'd the non-encrypted block with the plaintext, rendering the “encryption” trivially breakable. This will typically occur with deprecated or non-FIPS cipher algorithms (cipher-algo=blowfish/bf, twofish, cast5, or 3des). By default, pgcrypto will now fail to decrypt any messages that were affected in this way. To allow retrieval of such data, a new option ignore-cipher-failure has been added to pgp_pub_decrypt() and pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their previous behavior, allowing the faulty encryption wrapper to be stripped off: pgp_sym_decrypt(encrypted_column, any key, 'ignore-cipher-failure=1') Once the affected messages are identified and stripped of their wrappers, they can then be re-encrypted with a modern algorithm. It is important however that the behavior of OpenSSL be the same as it was when the faulty messages were created: if the set of unsupported algorithms is not the same, this approach will not work. See the documentation for ignore-cipher-failure. The PostgreSQL Project thanks Shishir Sharma for reporting this problem. (CVE-2026-14663)", "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "commits": ["6ca6023ca", "ba2a63faf"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "01cf5fe26c62ebd66ad79932beb6f0c28facca1b94896410dd85a1e66e53fdf3", "section_path": ["Changes"], "commit_groups": [["472ef7e4a", "6ca6023ca", "7e29eb6f4", "b05cfc693", "ba207f58f", "d0ecee6de", "fe32b10fc"], ["49e795414", "4c5128ca0", "7eed42aa8", "953be116c", "ba2a63faf", "d97b3f58c", "e2c48c81f"]], "identity_text": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers (Daniel Gustafsson) Previously, if OpenSSL rejected the requested cipher (for example, because it is running in FIPS mode, or the legacy provider hasn't been loaded), pgcrypto failed to notice the failure and simply XOR'd the non-encrypted block with the plaintext, rendering the encryption trivially breakable. This will typically occur with deprecated or non-FIPS cipher algorithms (cipher-algo=blowfish/bf, twofish, cast5, or 3des). By default, pgcrypto will now fail to decrypt any messages that were affected in this way. To allow retrieval of such data, a new option ignore-cipher-failure has been added to pgp_pub_decrypt() and pgp_sym_decrypt(). Setting ignore-cipher-failure=1 will restore their previous behavior, allowing the faulty encryption wrapper to be stripped off: pgp_sym_decrypt(encrypted_column, any key, 'ignore-cipher-failure=1') Once the affected messages are identified and stripped of their wrappers, they can then be re-encrypted with a modern algorithm. It is important however that the behavior of OpenSSL be the same as it was when the faulty messages were created: if the set of unsupported algorithms is not the same, this approach will not work. See the documentation for ignore-cipher-failure. The PostgreSQL Project thanks Shishir Sharma for reporting this problem. (CVE-2026-14663)", "commit_aliases": ["472ef7e4a", "49e795414", "4c5128ca0", "6ca6023ca", "7e29eb6f4", "7eed42aa8", "953be116c", "b05cfc693", "ba207f58f", "ba2a63faf", "d0ecee6de", "d97b3f58c", "e2c48c81f", "fe32b10fc"], "source_commits": ["6ca6023ca", "ba2a63faf"], "source_entry_id": "16.15/changes/002", "db_id": "5487cefec946cc3b492ec90f8407bbc0", "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f", "relations": [{"rule": 2, "type": "equivalent", "target": "28125c4ed11f62e12267d5aa58f29ab4", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}}, {"rule": 2, "type": "equivalent", "target": "379745809d65e827e6739e3818394675", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}}, {"rule": 2, "type": "equivalent", "target": "a686eb51b6b69a27a6ba670a1473120d", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}}, {"rule": 2, "type": "equivalent", "target": "e8d5337224696bc194016b8a5269940d", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "e8d5337224696bc194016b8a5269940d", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}, "url": "/docs/compare/?release=18.6#18.6-bfaa3421904d3a41", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "379745809d65e827e6739e3818394675", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}, "url": "/docs/compare/?release=17.11#17.11-165fa935d28df7f1", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "28125c4ed11f62e12267d5aa58f29ab4", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}, "url": "/docs/compare/?release=15.19#15.19-09644d5ff1559695", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "a686eb51b6b69a27a6ba670a1473120d", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "evidence": {"same_day": true, "patch_ids": ["0c0f3075fa6d42cb4f237a14111f3f86", "94579ce6ea64094f97312d8046fcb082"], "statement_hash": "f9b50dfe772a85830e7ce5570ba2e751618ceca0e1ebf0653490632965de190f"}, "url": "/docs/compare/?release=14.24#14.24-fdda567fdb9d909d", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-2edf36c62c37ac67", "cves": ["CVE-2026-6464"], "html": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN (Tom Lane) § §
Previously, if a COPY command failed at startup (for instance, because the target table doesn't exist) psql would not realize that and would proceed to read the following in-line data as SQL commands. In the best case that's wrong and in the worst case it's a SQL-injection hazard. Teach psql to recognize syntactically-valid COPY ... FROM STDIN commands and to skip data on its own authority if the server doesn't respond with PGRES_COPY_IN.
While this fix is unlikely to affect any production SQL scripts, test scripts might intentionally exercise failing COPY ... FROM STDIN commands. Those will need to gain a \\. data terminator line after each such command.
The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2026-6464)
", "text": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN (Tom Lane) § § Previously, if a COPY command failed at startup (for instance, because the target table doesn't exist) psql would not realize that and would proceed to read the following in-line data as SQL commands. In the best case that's wrong and in the worst case it's a SQL-injection hazard. Teach psql to recognize syntactically-valid COPY ... FROM STDIN commands and to skip data on its own authority if the server doesn't respond with PGRES_COPY_IN. While this fix is unlikely to affect any production SQL scripts, test scripts might intentionally exercise failing COPY ... FROM STDIN commands. Those will need to gain a \\. data terminator line after each such command. The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2026-6464)", "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "commits": ["2bdfd5cdc", "db96e87f9"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "7c7f96f28f7eef5904a8db00fbc83e5c36ea0bf326de3d4a651d83c3c588eb57", "section_path": ["Changes"], "commit_groups": [["29921259e", "2bdfd5cdc", "3045a25ba", "3fdcfa8f7", "46fa1f6f3", "5c51ae455", "d6ab88d37"], ["7215c7e96", "8cdbabea7", "8cf01e213", "900894d35", "cf754f741", "db96e87f9", "dca6627de"]], "identity_text": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN (Tom Lane) Previously, if a COPY command failed at startup (for instance, because the target table doesn't exist) psql would not realize that and would proceed to read the following in-line data as SQL commands. In the best case that's wrong and in the worst case it's a SQL-injection hazard. Teach psql to recognize syntactically-valid COPY ... FROM STDIN commands and to skip data on its own authority if the server doesn't respond with PGRES_COPY_IN. While this fix is unlikely to affect any production SQL scripts, test scripts might intentionally exercise failing COPY ... FROM STDIN commands. Those will need to gain a \\. data terminator line after each such command. The PostgreSQL Project thanks Alexander Lakhin for reporting this problem. (CVE-2026-6464)", "commit_aliases": ["29921259e", "2bdfd5cdc", "3045a25ba", "3fdcfa8f7", "46fa1f6f3", "5c51ae455", "7215c7e96", "8cdbabea7", "8cf01e213", "900894d35", "cf754f741", "d6ab88d37", "db96e87f9", "dca6627de"], "source_commits": ["2bdfd5cdc", "db96e87f9"], "source_entry_id": "16.15/changes/003", "db_id": "3fc8822e02c16e254582e2877b732705", "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225", "relations": [{"rule": 2, "type": "equivalent", "target": "3c7601286aa0c9239f3cd6933eeddc1f", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}}, {"rule": 2, "type": "equivalent", "target": "a4c84c6885a3a330efb43a5e79c7eeca", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}}, {"rule": 2, "type": "equivalent", "target": "df55d2444f4fc088a4a59341aed77733", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}}, {"rule": 2, "type": "equivalent", "target": "ea96c547a98f3910bcd150ec7a9bb871", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "3c7601286aa0c9239f3cd6933eeddc1f", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}, "url": "/docs/compare/?release=18.6#18.6-7711e8f6ad16c5dd", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "df55d2444f4fc088a4a59341aed77733", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}, "url": "/docs/compare/?release=17.11#17.11-8dd81897faaffe37", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "ea96c547a98f3910bcd150ec7a9bb871", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}, "url": "/docs/compare/?release=15.19#15.19-69623f56c9e9722f", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "a4c84c6885a3a330efb43a5e79c7eeca", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "evidence": {"same_day": true, "patch_ids": ["bb5ab12243a3045680f47ff1cb2c8480", "ecf5b4358ac3d55d48e5c5a6cf618bc5"], "statement_hash": "76e8147c7ad5a98f52d6ef02172b79adbee8009366c00ae89f0a205215b4b225"}, "url": "/docs/compare/?release=14.24#14.24-6d095df52bb23c05", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-82e9952b24a8b230", "cves": ["CVE-2026-16239"], "html": "Cross-check the output row type of a portal running EXECUTE or FETCH (Robert Haas) §
EXECUTE and FETCH use two portals: an outer one for the statement itself, and an inner one running the query being executed on its behalf. It was previously possible to make the declared row types of the two portals diverge, leading to server memory disclosure and arbitrary code execution.
The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) and Peter Geoghegan for reporting this problem. (CVE-2026-16239)
", "text": "Cross-check the output row type of a portal running EXECUTE or FETCH (Robert Haas) § EXECUTE and FETCH use two portals: an outer one for the statement itself, and an inner one running the query being executed on its behalf. It was previously possible to make the declared row types of the two portals diverge, leading to server memory disclosure and arbitrary code execution. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) and Peter Geoghegan for reporting this problem. (CVE-2026-16239)", "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "commits": ["7d150b5c9"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "fd7956f32d333ba4a41883082529be8bdaa9c8a2f51a635e150109b42ce8620b", "section_path": ["Changes"], "commit_groups": [["1f49beef2", "37b8f3b0e", "60887d348", "64a65ead1", "7d150b5c9", "9e02e2e18", "fc933ce00"]], "identity_text": "Cross-check the output row type of a portal running EXECUTE or FETCH (Robert Haas) EXECUTE and FETCH use two portals: an outer one for the statement itself, and an inner one running the query being executed on its behalf. It was previously possible to make the declared row types of the two portals diverge, leading to server memory disclosure and arbitrary code execution. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) and Peter Geoghegan for reporting this problem. (CVE-2026-16239)", "commit_aliases": ["1f49beef2", "37b8f3b0e", "60887d348", "64a65ead1", "7d150b5c9", "9e02e2e18", "fc933ce00"], "source_commits": ["7d150b5c9"], "source_entry_id": "16.15/changes/004", "db_id": "35f9a631aba647241e1c1fe3a3c4c269", "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073", "relations": [{"rule": 2, "type": "equivalent", "target": "3ec84f87545930ce1036d071dad3e665", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}}, {"rule": 2, "type": "equivalent", "target": "5b8818230400246029db8b181a69938c", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}}, {"rule": 2, "type": "equivalent", "target": "e2286cb0c701bb465fa540c1d4a45071", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}}, {"rule": 2, "type": "equivalent", "target": "e9fc65bf1c23945887e9b1904d08b935", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "5b8818230400246029db8b181a69938c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}, "url": "/docs/compare/?release=18.6#18.6-cdf902a8952d780f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "3ec84f87545930ce1036d071dad3e665", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}, "url": "/docs/compare/?release=17.11#17.11-b9a0ccf8cc602cca", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "e2286cb0c701bb465fa540c1d4a45071", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}, "url": "/docs/compare/?release=15.19#15.19-1912ca9b594fe54f", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "e9fc65bf1c23945887e9b1904d08b935", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "evidence": {"same_day": true, "patch_ids": ["bca9a8aea055bf40b974631f891c3459"], "statement_hash": "6bfdff724b157ff6ff7a59fd5879e05c524cc0a5a96ac58a33fa9750cc2db073"}, "url": "/docs/compare/?release=14.24#14.24-741f9481441d702d", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-f0ba58d9c922a403-1", "cves": ["CVE-2026-14669"], "html": "Fix buffer overrun with long time zone abbreviation in to_char() (Tom Lane) §
This can easily crash the server, and exploits leading to arbitrary code execution have been reported.
\nThe PostgreSQL Project thanks Hcamael, Amjad Shahzad, Tan Zhen of AntAISecurityLab, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem. (CVE-2026-14669)
", "text": "Fix buffer overrun with long time zone abbreviation in to_char() (Tom Lane) § This can easily crash the server, and exploits leading to arbitrary code execution have been reported. The PostgreSQL Project thanks Hcamael, Amjad Shahzad, Tan Zhen of AntAISecurityLab, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem. (CVE-2026-14669)", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "commits": ["5dbeb69bc"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "b9ed362da669f83dc9b5e1e19544e42f6d3885bea326ade91214ff32d3f7fb4a", "section_path": ["Changes"], "commit_groups": [["12a620686", "3294ab839", "3d724bf4f", "4fafe2380"], ["2cf28d1b9", "331016322", "5dbeb69bc", "5fb3c6389", "8f64cc83f", "b614de487", "bef46aed3"]], "identity_text": "Fix buffer overrun with long time zone abbreviation in to_char() (Tom Lane) This can easily crash the server, and exploits leading to arbitrary code execution have been reported. The PostgreSQL Project thanks Hcamael, Amjad Shahzad, Tan Zhen of AntAISecurityLab, Tomer Fichman, Zheng Yu, Amy Burnett (OpenAI Codex Security), Rick de Jager, Heewon Song, Sylvie Mayer, Aleksander Alekseev, and Hillai Ben Sasson for reporting this problem. (CVE-2026-14669)", "commit_aliases": ["12a620686", "2cf28d1b9", "3294ab839", "331016322", "3d724bf4f", "4fafe2380", "5dbeb69bc", "5fb3c6389", "8f64cc83f", "b614de487", "bef46aed3"], "source_commits": ["3d724bf4f", "5dbeb69bc"], "source_entry_id": "16.15/changes/005", "db_id": "70897dba323af27792543b2311799668", "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "relations": [{"rule": 2, "type": "equivalent", "target": "027ccc17f71deb2b38e14fc8cc82dccd", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "1b34d3e2b18d75096fd2914d3673446c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "1ba572e4a9f5584ecce320e293d4b258", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "771fa954f9b22168a0764dc12074dadb", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "b17ef22f538327cabf0726e1b3f902cc", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "bf82a2510c4dfe4309435e9bce0ab3a4", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "bfa74492dd2c8ed5f4b0a4321cb63c85", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "bfa88fa3d381bbc9b7ee7a8614ea363c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "ea24770278021c00f25a8b13bceb2a2c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "1ba572e4a9f5584ecce320e293d4b258", "kind": "related", "version": "18.6", "label": "18.6", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=18.6#18.6-e75bd84b8c02b997", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "1b34d3e2b18d75096fd2914d3673446c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=18.6#18.6-251aba36d837c523", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "bf82a2510c4dfe4309435e9bce0ab3a4", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=17.11#17.11-9aaf551ddc6d8e1b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b17ef22f538327cabf0726e1b3f902cc", "kind": "related", "version": "17.11", "label": "17.11", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=17.11#17.11-8291f394c20dacdc", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "bfa74492dd2c8ed5f4b0a4321cb63c85", "kind": "related", "version": "16.15", "label": "16.15", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=16.15#16.15-f0ba58d9c922a403-2", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES"}, {"db_id": "bfa88fa3d381bbc9b7ee7a8614ea363c", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=15.19#15.19-4395db3387c7cd38-1", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "771fa954f9b22168a0764dc12074dadb", "kind": "related", "version": "15.19", "label": "15.19", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=15.19#15.19-4395db3387c7cd38-2", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "ea24770278021c00f25a8b13bceb2a2c", "kind": "related", "version": "14.24", "label": "14.24", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=14.24#14.24-744489dc4872d6f1-2", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}, {"db_id": "027ccc17f71deb2b38e14fc8cc82dccd", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9", "f6e281e04c97bcdc5fa29a25f60517ca"], "statement_hash": "07a38d896c94ef2711ebb1c7c66bf1537f00d81b7488271a922229ab5b8f1962", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=14.24#14.24-744489dc4872d6f1-1", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-81cf49bd6b870f85", "cves": ["CVE-2026-14664"], "html": "Fix buffer overrun in regexp match/split functions (Masahiko Sawada) §
\nIf passed invalidly-encoded data, these functions could write past the end of their conversion buffer.
\nThe PostgreSQL Project thanks Francesco Verardi for reporting this problem. (CVE-2026-14664)
", "text": "Fix buffer overrun in regexp match/split functions (Masahiko Sawada) § If passed invalidly-encoded data, these functions could write past the end of their conversion buffer. The PostgreSQL Project thanks Francesco Verardi for reporting this problem. (CVE-2026-14664)", "title": "Fix buffer overrun in regexp match/split functions", "commits": ["3179253c2"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "20d4664cded0f25d8a549fec2b5bd7a69c0ec097e6b9ee2d9cfd9951b1d9c73f", "section_path": ["Changes"], "commit_groups": [["127a0673f", "3179253c2", "343aabf1d", "7df2aa8ef", "890327639", "b7e5c3f63", "e91dcfcca"]], "identity_text": "Fix buffer overrun in regexp match/split functions (Masahiko Sawada) If passed invalidly-encoded data, these functions could write past the end of their conversion buffer. The PostgreSQL Project thanks Francesco Verardi for reporting this problem. (CVE-2026-14664)", "commit_aliases": ["127a0673f", "3179253c2", "343aabf1d", "7df2aa8ef", "890327639", "b7e5c3f63", "e91dcfcca"], "source_commits": ["3179253c2"], "source_entry_id": "16.15/changes/006", "db_id": "2dff40febce19283ae38aa647816cd73", "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444", "relations": [{"rule": 2, "type": "equivalent", "target": "31c6d0327b9be4008171a2064e268f6c", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}}, {"rule": 2, "type": "equivalent", "target": "8e5a5f5c59f91019e7f4f9160ae97951", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}}, {"rule": 2, "type": "equivalent", "target": "ee22496a80ac478c7a0e734782b86377", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}}, {"rule": 2, "type": "equivalent", "target": "ee60c1b700f965a0913e70294c9927f5", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "31c6d0327b9be4008171a2064e268f6c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix buffer overrun in regexp match/split functions", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}, "url": "/docs/compare/?release=18.6#18.6-94204615ddc5390c", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "ee60c1b700f965a0913e70294c9927f5", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix buffer overrun in regexp match/split functions", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}, "url": "/docs/compare/?release=17.11#17.11-cb1b743a0208c3c0", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "ee22496a80ac478c7a0e734782b86377", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix buffer overrun in regexp match/split functions", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}, "url": "/docs/compare/?release=15.19#15.19-8a672df6043ea295", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "8e5a5f5c59f91019e7f4f9160ae97951", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix buffer overrun in regexp match/split functions", "evidence": {"same_day": true, "patch_ids": ["0cfa785ead8bfc886613fffe5a36e1bc"], "statement_hash": "966f554e1e936775481250a24075b22027e89685eec1e0c08a9bfd4f761ad444"}, "url": "/docs/compare/?release=14.24#14.24-e8fecccd48726ac8", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-483eebd2875e58ea", "cves": ["CVE-2026-18024"], "html": "Harden the ascii() function against invalid input (Michael Paquier) §
By supplying invalidly-encoded input, this function could be coaxed to read and return a few bytes of data that it shouldn't. In assert-enabled builds, its assertions could be triggered too.
\nThe PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-18024)
", "text": "Harden the ascii() function against invalid input (Michael Paquier) § By supplying invalidly-encoded input, this function could be coaxed to read and return a few bytes of data that it shouldn't. In assert-enabled builds, its assertions could be triggered too. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-18024)", "title": "Harden the ascii() function against invalid input", "commits": ["ac450853d"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "09aefa246abdd27ca57c0ce9988c9f516be930a942d34984254f8cc8861db12a", "section_path": ["Changes"], "commit_groups": [["08e812c02", "3b925133b", "42d333a78", "80ce920a5", "849da8210", "a16c31d39", "ac450853d"]], "identity_text": "Harden the ascii() function against invalid input (Michael Paquier) By supplying invalidly-encoded input, this function could be coaxed to read and return a few bytes of data that it shouldn't. In assert-enabled builds, its assertions could be triggered too. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-18024)", "commit_aliases": ["08e812c02", "3b925133b", "42d333a78", "80ce920a5", "849da8210", "a16c31d39", "ac450853d"], "source_commits": ["ac450853d"], "source_entry_id": "16.15/changes/007", "db_id": "5a7d1cc5fb2e41a7a2acbb0c59894992", "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3", "relations": [{"rule": 2, "type": "equivalent", "target": "12383fa89e42b03b68791e4222af5d42", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}}, {"rule": 2, "type": "equivalent", "target": "28116a0caca0f02980e6eaa33ad62878", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}}, {"rule": 2, "type": "equivalent", "target": "3fcea79a14fe4f9b97afbae1d619ffdf", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}}, {"rule": 2, "type": "equivalent", "target": "776c34393ca8da3ea9c128e3d7219ad3", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "28116a0caca0f02980e6eaa33ad62878", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Harden the ascii() function against invalid input", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}, "url": "/docs/compare/?release=18.6#18.6-4a45e658fb69cefb", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "12383fa89e42b03b68791e4222af5d42", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Harden the ascii() function against invalid input", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}, "url": "/docs/compare/?release=17.11#17.11-e6de3d1ea5ee5a52", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "3fcea79a14fe4f9b97afbae1d619ffdf", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Harden the ascii() function against invalid input", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}, "url": "/docs/compare/?release=15.19#15.19-7d22c46c0b1e985e", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "776c34393ca8da3ea9c128e3d7219ad3", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Harden the ascii() function against invalid input", "evidence": {"same_day": true, "patch_ids": ["55b264296776b9b13ab6e5f986e375f2"], "statement_hash": "30f93fe9d01d5c3e7f51b7ee86b38f0ddd66109774cc7f5bd732db874c26c1a3"}, "url": "/docs/compare/?release=14.24#14.24-7c4016acc1446315", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-ba8cb69723cdb335", "cves": ["CVE-2026-16238"], "html": "Fix multirange type handling in pg_restore_attribute_stats() (OpenAI Security Research Team)
pg_restore_attribute_stats() treated multirange types just like their underlying range type. This works correctly for the bounds histogram, but it was wrong for all the other statistics kinds.
The PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-16238)
", "text": "Fix multirange type handling in pg_restore_attribute_stats() (OpenAI Security Research Team) pg_restore_attribute_stats() treated multirange types just like their underlying range type. This works correctly for the bounds histogram, but it was wrong for all the other statistics kinds. The PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-16238)", "title": "Fix multirange type handling in pg_restore_attribute_stats()", "commits": [], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "307fae39b42e66fdb916abdaa0d4a62270ca6fbb1038040ff752f2c348b63a99", "section_path": ["Changes"], "commit_groups": [["08454e8b2", "57835938f", "b3d9262bb"], ["8d428c6e6"]], "identity_text": "Fix multirange type handling in pg_restore_attribute_stats() (OpenAI Security Research Team) pg_restore_attribute_stats() treated multirange types just like their underlying range type. This works correctly for the bounds histogram, but it was wrong for all the other statistics kinds. The PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-16238)", "commit_aliases": ["08454e8b2", "57835938f", "8d428c6e6", "b3d9262bb"], "source_commits": ["57835938f", "8d428c6e6"], "source_entry_id": "16.15/changes/008", "db_id": "e8b2ed03b7135b067945fe6134a48d0c", "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d", "relations": [{"rule": 2, "type": "equivalent", "target": "23063a48b3c2ddae3e3c1623fd1552b5", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}}, {"rule": 2, "type": "equivalent", "target": "7cdf19717697008d9621e1145ea725cc", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}}, {"rule": 2, "type": "equivalent", "target": "b73333feb74980fc954bc5f235124549", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}}, {"rule": 2, "type": "equivalent", "target": "c02d2730726a9bba001c3dcad007a406", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "b73333feb74980fc954bc5f235124549", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix multirange type handling in pg_restore_attribute_stats()", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}, "url": "/docs/compare/?release=18.6#18.6-61ef917ba36ebc0f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "c02d2730726a9bba001c3dcad007a406", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix multirange type handling in pg_restore_attribute_stats()", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}, "url": "/docs/compare/?release=17.11#17.11-ba8cb69723cdb335", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "7cdf19717697008d9621e1145ea725cc", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix multirange type handling in pg_restore_attribute_stats()", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}, "url": "/docs/compare/?release=15.19#15.19-ba8cb69723cdb335", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "23063a48b3c2ddae3e3c1623fd1552b5", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix multirange type handling in pg_restore_attribute_stats()", "evidence": {"same_day": true, "patch_ids": ["d27616df77f838ec6d65ceac3dab4d29", "e919d719afc48bf0f48ebde0e7586d45"], "statement_hash": "6c702ad16b71228cee81cbc85de20c25fe06c4ec29202dc0be958c9f409a702d"}, "url": "/docs/compare/?release=14.24#14.24-ba8cb69723cdb335", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-ae6cefffe2c19e7b", "cves": ["CVE-2026-14668"], "html": "Make scalarineqsel() check that a constant it expects to be of type tid actually is (Tom Lane) §
This expectation will hold for all the built-in operators that use this estimator, but a maliciously-constructed operator could violate it, leading to a crash or server memory disclosure.
\nThe PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14668)
", "text": "Make scalarineqsel() check that a constant it expects to be of type tid actually is (Tom Lane) § This expectation will hold for all the built-in operators that use this estimator, but a maliciously-constructed operator could violate it, leading to a crash or server memory disclosure. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14668)", "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "commits": ["591192e2e"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "afaaaedcd59d85f5dd7a89b89abf8ba9b8b28fa1e8710df9a190286aaf990936", "section_path": ["Changes"], "commit_groups": [["005ffaa7f", "0d60ee717", "0ebf896f4", "591192e2e", "59205c7e9", "8f0c3d2fe", "a2cb5a1cf"]], "identity_text": "Make scalarineqsel() check that a constant it expects to be of type tid actually is (Tom Lane) This expectation will hold for all the built-in operators that use this estimator, but a maliciously-constructed operator could violate it, leading to a crash or server memory disclosure. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14668)", "commit_aliases": ["005ffaa7f", "0d60ee717", "0ebf896f4", "591192e2e", "59205c7e9", "8f0c3d2fe", "a2cb5a1cf"], "source_commits": ["591192e2e"], "source_entry_id": "16.15/changes/009", "db_id": "8e21096b01a0beb228febdc9d9b21e1a", "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba", "relations": [{"rule": 2, "type": "equivalent", "target": "0c4b36600df59cbe54ae892784279e12", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}}, {"rule": 2, "type": "equivalent", "target": "7cbf7cb5e5571e3fde38e116219b7ff1", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}}, {"rule": 2, "type": "equivalent", "target": "97ac47be877760addc2f5b0afd4a077b", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}}, {"rule": 2, "type": "equivalent", "target": "9bd6480c825dec4b7dd7e98d8eca9b8f", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "97ac47be877760addc2f5b0afd4a077b", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}, "url": "/docs/compare/?release=18.6#18.6-d63d1269e786113b", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "7cbf7cb5e5571e3fde38e116219b7ff1", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}, "url": "/docs/compare/?release=17.11#17.11-3000fb5c37bacd7b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "0c4b36600df59cbe54ae892784279e12", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}, "url": "/docs/compare/?release=15.19#15.19-e5c6e044e35ae26d", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "9bd6480c825dec4b7dd7e98d8eca9b8f", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "evidence": {"same_day": true, "patch_ids": ["de7610ed8a59864556ff1fc7a996e26b"], "statement_hash": "9af3f49dfa69a353a456c0aa2751b844ae492634dd94bd7ac2ae7a38d22121ba"}, "url": "/docs/compare/?release=14.24#14.24-5956eea8fb565470", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-60c62245c66747ba", "cves": ["CVE-2026-14662"], "html": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length) (Tom Lane) § §
The documented limits were not enforced in all code paths.
\nThe PostgreSQL Project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu, and Hcamael for reporting these problems. (CVE-2026-14662)
", "text": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length) (Tom Lane) § § The documented limits were not enforced in all code paths. The PostgreSQL Project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu, and Hcamael for reporting these problems. (CVE-2026-14662)", "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "commits": ["7c1a8805a", "84b6a7a06"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "5585438bc59fc8cf29283947ea49b89bb00a2a5c3e969e4c4f25ae33a7c90be6", "section_path": ["Changes"], "commit_groups": [["1e3014f37", "3b2238fbe", "4f8b37b6b", "84b6a7a06", "8e87bd473", "90649b6f8", "dddc8a69f"], ["23d9ad771", "7c1a8805a", "7c2ba321d", "cb947ca31", "e25135057", "f443d0a0a", "fe0b5bd6d"]], "identity_text": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length) (Tom Lane) The documented limits were not enforced in all code paths. The PostgreSQL Project thanks Yuhang Wu, Zhenpeng Lin, Zheng Yu, and Hcamael for reporting these problems. (CVE-2026-14662)", "commit_aliases": ["1e3014f37", "23d9ad771", "3b2238fbe", "4f8b37b6b", "7c1a8805a", "7c2ba321d", "84b6a7a06", "8e87bd473", "90649b6f8", "cb947ca31", "dddc8a69f", "e25135057", "f443d0a0a", "fe0b5bd6d"], "source_commits": ["7c1a8805a", "84b6a7a06"], "source_entry_id": "16.15/changes/010", "db_id": "f4f98b5e09530fc0d9eabe85409d03ef", "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e", "relations": [{"rule": 2, "type": "equivalent", "target": "3d26273adc446717f1dd7040f0311025", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}}, {"rule": 2, "type": "equivalent", "target": "728b5628883585075c121bd29db0affe", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}}, {"rule": 2, "type": "equivalent", "target": "aa4dcca3c56a82ca052b2bdbc7e68c1b", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}}, {"rule": 2, "type": "equivalent", "target": "e8daa5e986b5139aa334ffb65fe716c9", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "e8daa5e986b5139aa334ffb65fe716c9", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}, "url": "/docs/compare/?release=18.6#18.6-774bcf033add5976", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "aa4dcca3c56a82ca052b2bdbc7e68c1b", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}, "url": "/docs/compare/?release=17.11#17.11-730aec962ef92894", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "3d26273adc446717f1dd7040f0311025", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}, "url": "/docs/compare/?release=15.19#15.19-17c179b4d9e41496", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "728b5628883585075c121bd29db0affe", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "evidence": {"same_day": true, "patch_ids": ["5d937de349e172af32f322b84994627c", "8594911de53a70a64ff7a92a7e2e7410"], "statement_hash": "58ee7f5cd2b407484897fe1a7e956c16ce0212b7ffe535ead9c50c21ba819c1e"}, "url": "/docs/compare/?release=14.24#14.24-60bda94b8310bec9", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-4e4499530e41620f", "cves": ["CVE-2026-14679"], "html": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments (Tom Lane) § §
Notably, the server's actual limit on the number of arguments to an aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to enforce that, creating hazards downstream.
The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko Sawada for reporting these problems. (CVE-2026-14679)
", "text": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments (Tom Lane) § § Notably, the server's actual limit on the number of arguments to an aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to enforce that, creating hazards downstream. The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko Sawada for reporting these problems. (CVE-2026-14679)", "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "commits": ["32e0d25d4", "8c67c4cf5"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "a58939a30dc66040cfdbd3476d23ba6cbdcb069c6b39eb630d447e666adff8e0", "section_path": ["Changes"], "commit_groups": [["2a03f21da", "32e0d25d4", "42d9749b7", "60e7329b9", "8a40f4b09", "c7f462838", "eb2fa2704"], ["797e3cc4c", "7bd56f7a3", "7f0e1aac7", "8c67c4cf5", "92972e815", "b417744a7", "cf44ff5e6"]], "identity_text": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments (Tom Lane) Notably, the server's actual limit on the number of arguments to an aggregate function is FUNC_MAX_ARGS - 1, but the parser failed to enforce that, creating hazards downstream. The PostgreSQL Project thanks Zheng Yu, ylwangtju, and Masahiko Sawada for reporting these problems. (CVE-2026-14679)", "commit_aliases": ["2a03f21da", "32e0d25d4", "42d9749b7", "60e7329b9", "797e3cc4c", "7bd56f7a3", "7f0e1aac7", "8a40f4b09", "8c67c4cf5", "92972e815", "b417744a7", "c7f462838", "cf44ff5e6", "eb2fa2704"], "source_commits": ["32e0d25d4", "8c67c4cf5"], "source_entry_id": "16.15/changes/011", "db_id": "bea7e191e30a8a238690f6d536666b13", "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f", "relations": [{"rule": 2, "type": "equivalent", "target": "349adc6ad9cc12d1c04aad6e3d659917", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}}, {"rule": 2, "type": "equivalent", "target": "41c6f110168cdb7324811a04a2654cf2", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}}, {"rule": 2, "type": "equivalent", "target": "4a55b4d9f252330dd0f0f94102631952", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}}, {"rule": 2, "type": "equivalent", "target": "b48c4a1b729ca10627402a86238f5a19", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "4a55b4d9f252330dd0f0f94102631952", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}, "url": "/docs/compare/?release=18.6#18.6-fe89a6f688a29e60", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "349adc6ad9cc12d1c04aad6e3d659917", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}, "url": "/docs/compare/?release=17.11#17.11-dd9a429d3ce13500", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "41c6f110168cdb7324811a04a2654cf2", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}, "url": "/docs/compare/?release=15.19#15.19-a19bdbedae40aee8", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "b48c4a1b729ca10627402a86238f5a19", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "evidence": {"same_day": true, "patch_ids": ["9c4aca692d373e760403997525c9e073", "ea0a783b3715942dc32c661399220cb1"], "statement_hash": "41c4e79daa1ea65508b91d04fa5138fb9c313606a4ceade697072cb89843941f"}, "url": "/docs/compare/?release=14.24#14.24-573a25e391fc116a", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-34c662185f18a805", "cves": ["CVE-2026-14680"], "html": "Reject calls from SQL to functions that take or return type internal (Tom Lane) § §
The existing defenses against doing this have been shown to be insufficient, so add more explicit checks.
\nThe PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-14680)
", "text": "Reject calls from SQL to functions that take or return type internal (Tom Lane) § § The existing defenses against doing this have been shown to be insufficient, so add more explicit checks. The PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-14680)", "title": "Reject calls from SQL to functions that take or return type internal", "commits": ["4c0c1b2cd", "7f308dd7c"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "3ff9d542ed91807c11d45da01f6f2e27539d7f596001d306c8baf8550d38b9ae", "section_path": ["Changes"], "commit_groups": [["155dacbc5", "21a00de43", "4c0c1b2cd", "54649de65", "8f7e35b08", "e926a9aac", "eb9e55297"], ["1aa601b4f", "21d8cfb18", "722695db1", "7f308dd7c", "83d0a083f", "913fe0c31", "d6e861e19"]], "identity_text": "Reject calls from SQL to functions that take or return type internal (Tom Lane) The existing defenses against doing this have been shown to be insufficient, so add more explicit checks. The PostgreSQL Project thanks Amy Burnett (OpenAI Codex Security) for reporting this problem. (CVE-2026-14680)", "commit_aliases": ["155dacbc5", "1aa601b4f", "21a00de43", "21d8cfb18", "4c0c1b2cd", "54649de65", "722695db1", "7f308dd7c", "83d0a083f", "8f7e35b08", "913fe0c31", "d6e861e19", "e926a9aac", "eb9e55297"], "source_commits": ["4c0c1b2cd", "7f308dd7c"], "source_entry_id": "16.15/changes/012", "db_id": "e54c1abdbc2feb1d5c81f31cc4a073f8", "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f", "relations": [{"rule": 2, "type": "equivalent", "target": "02bb5a11139923dd7f170a94556495c3", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}}, {"rule": 2, "type": "equivalent", "target": "42aa2e3353b4536c48a5271f47f0eb90", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}}, {"rule": 2, "type": "equivalent", "target": "97ff2029068cd51a1802927b5b54f2d3", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}}, {"rule": 2, "type": "equivalent", "target": "b56373871b3aaa929aaba36a65e4eb45", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "02bb5a11139923dd7f170a94556495c3", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Reject calls from SQL to functions that take or return type internal", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}, "url": "/docs/compare/?release=18.6#18.6-a8d1f97d70d85295", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "42aa2e3353b4536c48a5271f47f0eb90", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Reject calls from SQL to functions that take or return type internal", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}, "url": "/docs/compare/?release=17.11#17.11-ea70ef62a58da283", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "97ff2029068cd51a1802927b5b54f2d3", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Reject calls from SQL to functions that take or return type internal", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}, "url": "/docs/compare/?release=15.19#15.19-945b15baee4c22d6", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "b56373871b3aaa929aaba36a65e4eb45", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Reject calls from SQL to functions that take or return type internal", "evidence": {"same_day": true, "patch_ids": ["8b623dad3bf883bcb9bd41023fc8f168", "b94f9935e7be4a2be88c49eae8a6ae70"], "statement_hash": "713f97bceae2187dec2f42b397097077fb7eec20b6eddb9a6fb32f8878d44f9f"}, "url": "/docs/compare/?release=14.24#14.24-d4901f423633ca69", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-e8ff71640bff6e1b", "cves": ["CVE-2026-6469"], "html": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE (Masahiko Sawada) §
Previously, the role running ALTER TABLE gained ownership of such objects, but that seems inappropriate.
The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6469)
", "text": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE (Masahiko Sawada) § Previously, the role running ALTER TABLE gained ownership of such objects, but that seems inappropriate. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6469)", "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "commits": ["7c3367ab5"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "e5d3ca5e4763853b9fc9bb9a854d0b4eab6d6c3c3345c0080225d822a3c2033d", "section_path": ["Changes"], "commit_groups": [["6713a6e04", "70a3b4e18", "75a03c569", "7c3367ab5", "93b93f28f", "a1fa24127", "fb6d1ca8d"]], "identity_text": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE (Masahiko Sawada) Previously, the role running ALTER TABLE gained ownership of such objects, but that seems inappropriate. The PostgreSQL Project thanks Noah Misch for reporting this problem. (CVE-2026-6469)", "commit_aliases": ["6713a6e04", "70a3b4e18", "75a03c569", "7c3367ab5", "93b93f28f", "a1fa24127", "fb6d1ca8d"], "source_commits": ["7c3367ab5"], "source_entry_id": "16.15/changes/013", "db_id": "a45d7275fb35413aaeeb017f13dfbf83", "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6", "relations": [{"rule": 2, "type": "equivalent", "target": "4ce18d2a1cf23ef6c7ff55c667d59eae", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}}, {"rule": 2, "type": "equivalent", "target": "a511c71fb1c56e7bba21699bf176d02f", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}}, {"rule": 2, "type": "equivalent", "target": "ddb05610c858789527b1369d30b4bb1c", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}}, {"rule": 2, "type": "equivalent", "target": "f73abeba4ef827229ec4b724b2dbde1b", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "4ce18d2a1cf23ef6c7ff55c667d59eae", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}, "url": "/docs/compare/?release=18.6#18.6-c42539c16ee68f2f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "a511c71fb1c56e7bba21699bf176d02f", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}, "url": "/docs/compare/?release=17.11#17.11-50a00c5a01592c04", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "ddb05610c858789527b1369d30b4bb1c", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}, "url": "/docs/compare/?release=15.19#15.19-b4f58a948680ef82", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f73abeba4ef827229ec4b724b2dbde1b", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "evidence": {"same_day": true, "patch_ids": ["c847f131eaad282f5fa724ff040f1fc2"], "statement_hash": "855872db5602ac9ec63e8c9b362b906eef0f29c2ae3da9a0473220149fc815a6"}, "url": "/docs/compare/?release=14.24#14.24-dd4b41945f77ff4b", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-b95737c58db91b67", "cves": ["CVE-2026-15741"], "html": "When deparsing an EXTRACT() function call, quote the field name if needed (Nathan Bossart) §
The parser accepts any string literal as a field name in EXTRACT(), deferring validation to execution. If the call is stored and deparsed (for example during pg_dump), the string body was regurgitated verbatim, allowing SQL injection.
The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15741)
", "text": "When deparsing an EXTRACT() function call, quote the field name if needed (Nathan Bossart) § The parser accepts any string literal as a field name in EXTRACT(), deferring validation to execution. If the call is stored and deparsed (for example during pg_dump), the string body was regurgitated verbatim, allowing SQL injection. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15741)", "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "commits": ["5e5ea74e3"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "6e77dca4c733b1f09176c5569d84ede31fa5c9336f6d089b4386062835caf61a", "section_path": ["Changes"], "commit_groups": [["0ddd9098a", "44ea6764b", "5981fe370", "5e5ea74e3", "967acab87", "a3832a757", "f9729b507"]], "identity_text": "When deparsing an EXTRACT() function call, quote the field name if needed (Nathan Bossart) The parser accepts any string literal as a field name in EXTRACT(), deferring validation to execution. If the call is stored and deparsed (for example during pg_dump), the string body was regurgitated verbatim, allowing SQL injection. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15741)", "commit_aliases": ["0ddd9098a", "44ea6764b", "5981fe370", "5e5ea74e3", "967acab87", "a3832a757", "f9729b507"], "source_commits": ["5e5ea74e3"], "source_entry_id": "16.15/changes/014", "db_id": "46e3e259f29471b862d3a1eeaae97525", "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef", "relations": [{"rule": 2, "type": "equivalent", "target": "0b6c8ce7fe6e116e2bb99be5e53dff29", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}}, {"rule": 2, "type": "equivalent", "target": "57a69063ff0b7f44b253f158536bbc64", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}}, {"rule": 2, "type": "equivalent", "target": "7c6c8c33a06891c077c2444b81e229fb", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}}, {"rule": 2, "type": "equivalent", "target": "9677e1d0e314b1250191bf908cc27099", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "57a69063ff0b7f44b253f158536bbc64", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}, "url": "/docs/compare/?release=18.6#18.6-323a1fc7b03b6859", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "9677e1d0e314b1250191bf908cc27099", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}, "url": "/docs/compare/?release=17.11#17.11-2bafbd49437d6dde", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "0b6c8ce7fe6e116e2bb99be5e53dff29", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}, "url": "/docs/compare/?release=15.19#15.19-a14e35e1025f9ddc", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "7c6c8c33a06891c077c2444b81e229fb", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "evidence": {"same_day": true, "patch_ids": ["f0b1d31c8ffb5349b650b0e3b88706ad"], "statement_hash": "8fb62033eeb6ede7911fce4b990d20a94bf88226d146867552627bcce9f533ef"}, "url": "/docs/compare/?release=14.24#14.24-6222e3f0de511b22", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-0bb6468faf69c61b", "cves": ["CVE-2026-6470"], "html": "Check for USAGE privilege on data types in places that formerly failed to check that (Nathan Bossart) § § §
CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did commands that create stored expressions. These omissions allowed roles without USAGE privilege to nonetheless create objects depending on the type, possibly blocking the type's owner from changing the type later.
The PostgreSQL Project thanks Jingzhou Fu for reporting this problem. (CVE-2026-6470)
", "text": "Check for USAGE privilege on data types in places that formerly failed to check that (Nathan Bossart) § § § CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did commands that create stored expressions. These omissions allowed roles without USAGE privilege to nonetheless create objects depending on the type, possibly blocking the type's owner from changing the type later. The PostgreSQL Project thanks Jingzhou Fu for reporting this problem. (CVE-2026-6470)", "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "commits": ["24855357c", "7a761fe40", "7ce056b17"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "13a25a2d0517f77a6df5b4d7a423ccc2db9cebae8c416987d4f3568cd58da325", "section_path": ["Changes"], "commit_groups": [["1a358b8f2", "278053843", "424fb7160", "4fac4c108", "6dbedd48b", "7ce056b17", "d1c8aa0b0"], ["24855357c", "2e91f8548", "323af0a4e", "97e277402", "a9f6e768a", "efdb26072", "fd6d3e7e9"], ["53ed5ebd8", "57f59ca1d", "671359605", "7a761fe40", "b6e45b4f8", "bb1bc525d", "c062734cd"]], "identity_text": "Check for USAGE privilege on data types in places that formerly failed to check that (Nathan Bossart) CREATE TYPE AS RANGE did not check, nor did ALTER TABLE OF, nor did commands that create stored expressions. These omissions allowed roles without USAGE privilege to nonetheless create objects depending on the type, possibly blocking the type's owner from changing the type later. The PostgreSQL Project thanks Jingzhou Fu for reporting this problem. (CVE-2026-6470)", "commit_aliases": ["1a358b8f2", "24855357c", "278053843", "2e91f8548", "323af0a4e", "424fb7160", "4fac4c108", "53ed5ebd8", "57f59ca1d", "671359605", "6dbedd48b", "7a761fe40", "7ce056b17", "97e277402", "a9f6e768a", "b6e45b4f8", "bb1bc525d", "c062734cd", "d1c8aa0b0", "efdb26072", "fd6d3e7e9"], "source_commits": ["24855357c", "7a761fe40", "7ce056b17"], "source_entry_id": "16.15/changes/015", "db_id": "f2f63cd272a4e4c0c968eacb6779415b", "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068", "relations": [{"rule": 2, "type": "equivalent", "target": "56232d6e6345f5c09340b72ed581eb4d", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}}, {"rule": 2, "type": "equivalent", "target": "8c93b6ddad829461b98126755a87488f", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}}, {"rule": 2, "type": "equivalent", "target": "e50027af5564cb33c0ec80ab0f86e1a9", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}}, {"rule": 2, "type": "equivalent", "target": "f44708d4a1d626e3b8656335ae598c69", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "56232d6e6345f5c09340b72ed581eb4d", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}, "url": "/docs/compare/?release=18.6#18.6-0b5cda175039a2c3", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "e50027af5564cb33c0ec80ab0f86e1a9", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}, "url": "/docs/compare/?release=17.11#17.11-575634f97737603c", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "8c93b6ddad829461b98126755a87488f", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}, "url": "/docs/compare/?release=15.19#15.19-680192fcb0e07883", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f44708d4a1d626e3b8656335ae598c69", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "evidence": {"same_day": true, "patch_ids": ["2470df146b9201b14de19f772c90d867", "2de75ceea92e216f0b0f3ec035342d7e", "76d1b8b6ad0cee83e43cc4a88d123867"], "statement_hash": "f6ec51b2de1a066951596511e998a5e51ac29a83e3c8e018df4d6e981ebe7068"}, "url": "/docs/compare/?release=14.24#14.24-045d18982c440e91", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-c1ecfb608aa3193c", "cves": ["CVE-2026-14666"], "html": "Invalidate role-dependent cached plans after role changes (Ilya Staroverov, Shinya Kato, Nathan Bossart) §
\nRole membership, role attribute, and database ownership changes may impact the expected behavior of row-level security policies, but previously we'd continue to use cached plans that were made according to the old state of affairs.
\nThe PostgreSQL Project thanks Ilya Staroverov and Shinya Kato for reporting this problem. (CVE-2026-14666)
", "text": "Invalidate role-dependent cached plans after role changes (Ilya Staroverov, Shinya Kato, Nathan Bossart) § Role membership, role attribute, and database ownership changes may impact the expected behavior of row-level security policies, but previously we'd continue to use cached plans that were made according to the old state of affairs. The PostgreSQL Project thanks Ilya Staroverov and Shinya Kato for reporting this problem. (CVE-2026-14666)", "title": "Invalidate role-dependent cached plans after role changes", "commits": ["f5f2da795"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "4ca3b4c5f1e4f5e9e71f9183d0118874081c9bbf3ba304ad922eba2e8bfd7bf3", "section_path": ["Changes"], "commit_groups": [["0b12f56bf", "17b6083db", "1974acf23", "567286b76", "f4174aa84", "f5f2da795", "ffca23839"]], "identity_text": "Invalidate role-dependent cached plans after role changes (Ilya Staroverov, Shinya Kato, Nathan Bossart) Role membership, role attribute, and database ownership changes may impact the expected behavior of row-level security policies, but previously we'd continue to use cached plans that were made according to the old state of affairs. The PostgreSQL Project thanks Ilya Staroverov and Shinya Kato for reporting this problem. (CVE-2026-14666)", "commit_aliases": ["0b12f56bf", "17b6083db", "1974acf23", "567286b76", "f4174aa84", "f5f2da795", "ffca23839"], "source_commits": ["f5f2da795"], "source_entry_id": "16.15/changes/016", "db_id": "c1425f2f64ac014a0d5ac494fbe66faf", "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432", "relations": [{"rule": 2, "type": "equivalent", "target": "043b1e2a717a3c7862402faa9c4b1f91", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}}, {"rule": 2, "type": "equivalent", "target": "0e200ae2afa3db031ffa07314f2deab2", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}}, {"rule": 2, "type": "equivalent", "target": "49941507efa272e723ff0698b2236a6e", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}}, {"rule": 2, "type": "equivalent", "target": "652fbbbd4aff8c1d5babff0cde01bc7f", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "0e200ae2afa3db031ffa07314f2deab2", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Invalidate role-dependent cached plans after role changes", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}, "url": "/docs/compare/?release=18.6#18.6-ad01030c7fc964f1", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "49941507efa272e723ff0698b2236a6e", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Invalidate role-dependent cached plans after role changes", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}, "url": "/docs/compare/?release=17.11#17.11-43977a837123cada", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "652fbbbd4aff8c1d5babff0cde01bc7f", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Invalidate role-dependent cached plans after role changes", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}, "url": "/docs/compare/?release=15.19#15.19-90c7239f7a1b81bc", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "043b1e2a717a3c7862402faa9c4b1f91", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Invalidate role-dependent cached plans after role changes", "evidence": {"same_day": true, "patch_ids": ["7a5d6580a542a5467ce64bfd9ad2b724"], "statement_hash": "b27f8aace3b388937c6e28c9f1ede652d42059e6b0a2111846c88a4b39769432"}, "url": "/docs/compare/?release=14.24#14.24-6987bc0045f3c2c5", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-c6bce83a8c49af2c", "cves": ["CVE-2026-14681"], "html": "Reject GSSEncRequest after direct SSL connection (Michael Paquier)
\nAfter establishing a TLS-encrypted connection, the server would still accept a request for GSSAPI encryption. If that succeeded, the connection would proceed using TLS encryption, but it would look like a GSS connection to the pg_hba rules. Thus, a pg_hba policy intending to disallow TLS would not be enforced correctly.
The PostgreSQL Project thanks p4p3r for reporting this problem. (CVE-2026-14681)
", "text": "Reject GSSEncRequest after direct SSL connection (Michael Paquier) After establishing a TLS-encrypted connection, the server would still accept a request for GSSAPI encryption. If that succeeded, the connection would proceed using TLS encryption, but it would look like a GSS connection to the pg_hba rules. Thus, a pg_hba policy intending to disallow TLS would not be enforced correctly. The PostgreSQL Project thanks p4p3r for reporting this problem. (CVE-2026-14681)", "title": "Reject GSSEncRequest after direct SSL connection", "commits": [], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "3a80c1fa3c798768f5b8abd7b20fca6ea90342fa6a41d7a0e2a6810188ef6da5", "section_path": ["Changes"], "commit_groups": [["067a64d40", "203a48209", "3bf185b4b", "bf1bb7e29"]], "identity_text": "Reject GSSEncRequest after direct SSL connection (Michael Paquier) After establishing a TLS-encrypted connection, the server would still accept a request for GSSAPI encryption. If that succeeded, the connection would proceed using TLS encryption, but it would look like a GSS connection to the pg_hba rules. Thus, a pg_hba policy intending to disallow TLS would not be enforced correctly. The PostgreSQL Project thanks p4p3r for reporting this problem. (CVE-2026-14681)", "commit_aliases": ["067a64d40", "203a48209", "3bf185b4b", "bf1bb7e29"], "source_commits": ["3bf185b4b"], "source_entry_id": "16.15/changes/017", "db_id": "fae551c24851f8412783e17b85987136", "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620", "relations": [{"rule": 2, "type": "equivalent", "target": "55da165c3ced2d17689a546cd13a10f8", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}}, {"rule": 2, "type": "equivalent", "target": "bdd453999af206604b4ae0c623733bc5", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}}, {"rule": 2, "type": "equivalent", "target": "deae128594614e84894b8e7a7062759f", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}}, {"rule": 2, "type": "equivalent", "target": "efca948aece74421d5dff07ca459356e", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "deae128594614e84894b8e7a7062759f", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Reject GSSEncRequest after direct SSL connection", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}, "url": "/docs/compare/?release=18.6#18.6-ed40b113af1a65e3", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "55da165c3ced2d17689a546cd13a10f8", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Reject GSSEncRequest after direct SSL connection", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}, "url": "/docs/compare/?release=17.11#17.11-1d103f53312d0305", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "bdd453999af206604b4ae0c623733bc5", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Reject GSSEncRequest after direct SSL connection", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}, "url": "/docs/compare/?release=15.19#15.19-c6bce83a8c49af2c", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "efca948aece74421d5dff07ca459356e", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Reject GSSEncRequest after direct SSL connection", "evidence": {"same_day": true, "patch_ids": ["0a86d0c924c70e8b47408f823a77a964"], "statement_hash": "f08040a4f6b5dfe94a4b30090677fd13c199828e108149421fa23eaa60d5f620"}, "url": "/docs/compare/?release=14.24#14.24-c6bce83a8c49af2c", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-7aa6af5006f81e6f", "cves": ["CVE-2026-14672"], "html": "Make mock SCRAM authentication secrets more plausible (Nathan Bossart) §
\nIf a SCRAM login is attempted against a role that doesn't exist or doesn't have a SCRAM secret, we generate a mock secret and carry out the authentication handshake anyway, to avoid revealing these facts to an attacker. But the mock secret was made with a fixed iteration count, which in itself can be an observable response discrepancy. Use the configuration setting scram_iterations instead, to make the mock secret look more like the installation's real secrets.
The PostgreSQL Project thanks Radim Marek for reporting this problem. (CVE-2026-14672)
", "text": "Make mock SCRAM authentication secrets more plausible (Nathan Bossart) § If a SCRAM login is attempted against a role that doesn't exist or doesn't have a SCRAM secret, we generate a mock secret and carry out the authentication handshake anyway, to avoid revealing these facts to an attacker. But the mock secret was made with a fixed iteration count, which in itself can be an observable response discrepancy. Use the configuration setting scram_iterations instead, to make the mock secret look more like the installation's real secrets. The PostgreSQL Project thanks Radim Marek for reporting this problem. (CVE-2026-14672)", "title": "Make mock SCRAM authentication secrets more plausible", "commits": ["fadbe882d"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "de0b2531a7782a5aafdf7dbf1532e2e74515cb411a291b56e7b15d76fb667473", "section_path": ["Changes"], "commit_groups": [["4d192fa16", "822143c4d", "dec60e8ad", "fadbe882d", "feb8b0182"]], "identity_text": "Make mock SCRAM authentication secrets more plausible (Nathan Bossart) If a SCRAM login is attempted against a role that doesn't exist or doesn't have a SCRAM secret, we generate a mock secret and carry out the authentication handshake anyway, to avoid revealing these facts to an attacker. But the mock secret was made with a fixed iteration count, which in itself can be an observable response discrepancy. Use the configuration setting scram_iterations instead, to make the mock secret look more like the installation's real secrets. The PostgreSQL Project thanks Radim Marek for reporting this problem. (CVE-2026-14672)", "commit_aliases": ["4d192fa16", "822143c4d", "dec60e8ad", "fadbe882d", "feb8b0182"], "source_commits": ["fadbe882d"], "source_entry_id": "16.15/changes/018", "db_id": "adc5092861582d88d34f6a1b1124f2eb", "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178", "relations": [{"rule": 2, "type": "equivalent", "target": "0b4b5a7457f7fbba0ac49362d4205d94", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}}, {"rule": 2, "type": "equivalent", "target": "328f985aab0b40a393740fb418be993c", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}}, {"rule": 2, "type": "equivalent", "target": "360618cf2b5023ffb07258f47a407319", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}}, {"rule": 2, "type": "equivalent", "target": "465da641b2ad8e32d9b3eff9044cfd21", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "360618cf2b5023ffb07258f47a407319", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Make mock SCRAM authentication secrets more plausible", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}, "url": "/docs/compare/?release=18.6#18.6-bb742148aa1ab70a", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "465da641b2ad8e32d9b3eff9044cfd21", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Make mock SCRAM authentication secrets more plausible", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}, "url": "/docs/compare/?release=17.11#17.11-f319d2c2bdee8718", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "328f985aab0b40a393740fb418be993c", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Make mock SCRAM authentication secrets more plausible", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}, "url": "/docs/compare/?release=15.19#15.19-df0f61cd55651315", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "0b4b5a7457f7fbba0ac49362d4205d94", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Make mock SCRAM authentication secrets more plausible", "evidence": {"same_day": true, "patch_ids": ["b915b0f76ef63e3fd030de3a5e4052c7"], "statement_hash": "76daff375fab06e676eed2c7ce655a806a67e546c22e89cce3f2506387c91178"}, "url": "/docs/compare/?release=14.24#14.24-df0f61cd55651315", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-e48a8391a0609721", "cves": ["CVE-2026-16241"], "html": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server (Michael Paquier) §
ecpg assumed without checking that any bytea value must begin with \\x. A broken or malicious server might send a string shorter than 2 bytes, resulting in memory clobber in the application.
The PostgreSQL Project thanks ylwangtju for reporting this problem. (CVE-2026-16241)
", "text": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server (Michael Paquier) § ecpg assumed without checking that any bytea value must begin with \\x. A broken or malicious server might send a string shorter than 2 bytes, resulting in memory clobber in the application. The PostgreSQL Project thanks ylwangtju for reporting this problem. (CVE-2026-16241)", "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "commits": ["39f855e0e"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "f7b73c860ce830850d1c046d1b244b0150562926b358be39fac1c9edebe0d8bc", "section_path": ["Changes"], "commit_groups": [["39f855e0e", "457b8737a", "5737110b6", "74c59d062", "a14ba29b1", "c3c830272", "c7da85fec"]], "identity_text": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server (Michael Paquier) ecpg assumed without checking that any bytea value must begin with \\x. A broken or malicious server might send a string shorter than 2 bytes, resulting in memory clobber in the application. The PostgreSQL Project thanks ylwangtju for reporting this problem. (CVE-2026-16241)", "commit_aliases": ["39f855e0e", "457b8737a", "5737110b6", "74c59d062", "a14ba29b1", "c3c830272", "c7da85fec"], "source_commits": ["39f855e0e"], "source_entry_id": "16.15/changes/019", "db_id": "f5473f236236eb170503879999034ecc", "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946", "relations": [{"rule": 2, "type": "equivalent", "target": "18aec69fea13406451ddcbd0d4c23a88", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}}, {"rule": 2, "type": "equivalent", "target": "4fb7c5910a0436ce3e2bb2ab88b25a87", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}}, {"rule": 2, "type": "equivalent", "target": "7393e9b24b9abe3400e3f04577d58cba", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}}, {"rule": 2, "type": "equivalent", "target": "c7e226410c72dad9c39b76d880e2f2a5", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "c7e226410c72dad9c39b76d880e2f2a5", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}, "url": "/docs/compare/?release=18.6#18.6-2d9ddb6163eca29a", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "4fb7c5910a0436ce3e2bb2ab88b25a87", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}, "url": "/docs/compare/?release=17.11#17.11-368d04431d80a7fd", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "18aec69fea13406451ddcbd0d4c23a88", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}, "url": "/docs/compare/?release=15.19#15.19-8ab80940f2e8c31e", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "7393e9b24b9abe3400e3f04577d58cba", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "evidence": {"same_day": true, "patch_ids": ["eda4e515c03b7210bd33a13cc191c754"], "statement_hash": "ef3db74c8b626f19d33ecc7d3b8e292c1e11cd1089b59edbc38f72bd729fe946"}, "url": "/docs/compare/?release=14.24#14.24-a12e893b89f31441", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-59649e9a46bbab2a", "cves": ["CVE-2025-8714", "CVE-2026-18408"], "html": "Do not do backquote expansion on the argument of psql's \\unrestrict command (Nathan Bossart) §
This oversight in the fix for CVE-2025-8714 allows a malicious server to inject shell commands into plain-text dump output that will be run at restore time on the machine running psql, the exact scenario that CVE-2025-8714 intended to prevent.
\nThe PostgreSQL Project thanks Lucas Velgus, Filip Janus, and Daniel Bakker for reporting this problem. (CVE-2026-18408)
", "text": "Do not do backquote expansion on the argument of psql's \\unrestrict command (Nathan Bossart) § This oversight in the fix for CVE-2025-8714 allows a malicious server to inject shell commands into plain-text dump output that will be run at restore time on the machine running psql, the exact scenario that CVE-2025-8714 intended to prevent. The PostgreSQL Project thanks Lucas Velgus, Filip Janus, and Daniel Bakker for reporting this problem. (CVE-2026-18408)", "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "commits": ["33d0c63fb"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "cb620359e64a158c37d032e5fb0f29680e7ea66350e08a293ba068d0aeabc7fd", "section_path": ["Changes"], "commit_groups": [["0119aa30e", "086f6f176", "0bfac9e1f", "2006fca40", "33d0c63fb", "71ca694c7", "df245c374"]], "identity_text": "Do not do backquote expansion on the argument of psql's \\unrestrict command (Nathan Bossart) This oversight in the fix for CVE-2025-8714 allows a malicious server to inject shell commands into plain-text dump output that will be run at restore time on the machine running psql, the exact scenario that CVE-2025-8714 intended to prevent. The PostgreSQL Project thanks Lucas Velgus, Filip Janus, and Daniel Bakker for reporting this problem. (CVE-2026-18408)", "commit_aliases": ["0119aa30e", "086f6f176", "0bfac9e1f", "2006fca40", "33d0c63fb", "71ca694c7", "df245c374"], "source_commits": ["33d0c63fb"], "source_entry_id": "16.15/changes/020", "db_id": "7a747536f32a440151dcb2b04ac4e968", "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b", "relations": [{"rule": 2, "type": "equivalent", "target": "36ccc2b6f4b04376dc6bf74ae3d2f6de", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}}, {"rule": 2, "type": "equivalent", "target": "49dd1006826cb5f529df97b64194c139", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}}, {"rule": 2, "type": "equivalent", "target": "5221242491685338de78e8922e1f353a", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}}, {"rule": 2, "type": "equivalent", "target": "56ffc2f53e9a050b5de71327d3cef06f", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "36ccc2b6f4b04376dc6bf74ae3d2f6de", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}, "url": "/docs/compare/?release=18.6#18.6-2227ccac7ef5135c", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "56ffc2f53e9a050b5de71327d3cef06f", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}, "url": "/docs/compare/?release=17.11#17.11-7f417b32587acff8", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "5221242491685338de78e8922e1f353a", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}, "url": "/docs/compare/?release=15.19#15.19-1eaa89bc0932599c", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "49dd1006826cb5f529df97b64194c139", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "evidence": {"same_day": true, "patch_ids": ["061af71132ccdfb4f1bbeed893be595c"], "statement_hash": "3a14df9ccfd7372d3dac771a23f52e41c3376ea71cf1946e2c9e95f97d2b5d3b"}, "url": "/docs/compare/?release=14.24#14.24-383244a3d19a3ddf", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-d0330343bf3a2bca", "cves": ["CVE-2026-19385"], "html": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries (Tom Lane) §
Since there could be entries for both input and output arguments, it's feasible for this array's length to exceed FUNC_MAX_ARGS (which constrains only input arguments). Even if that were not so, pg_dump cannot assume that the server was built with the same value of FUNC_MAX_ARGS that it has. An overrun would lead to a memory clobber inside pg_dump.
The PostgreSQL Project thanks Masahiko Sawada for reporting this problem. (CVE-2026-19385)
", "text": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries (Tom Lane) § Since there could be entries for both input and output arguments, it's feasible for this array's length to exceed FUNC_MAX_ARGS (which constrains only input arguments). Even if that were not so, pg_dump cannot assume that the server was built with the same value of FUNC_MAX_ARGS that it has. An overrun would lead to a memory clobber inside pg_dump. The PostgreSQL Project thanks Masahiko Sawada for reporting this problem. (CVE-2026-19385)", "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "commits": ["3299c2ba0"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "35269180620a3412e6abf252edaede867e2a63403a257ad0ff8f4a3204f43b85", "section_path": ["Changes"], "commit_groups": [["13bb73aeb", "3299c2ba0", "3392cce5c", "57aa21f69", "71ba5705d", "86cd82bf4", "c2b16f5d4"]], "identity_text": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries (Tom Lane) Since there could be entries for both input and output arguments, it's feasible for this array's length to exceed FUNC_MAX_ARGS (which constrains only input arguments). Even if that were not so, pg_dump cannot assume that the server was built with the same value of FUNC_MAX_ARGS that it has. An overrun would lead to a memory clobber inside pg_dump. The PostgreSQL Project thanks Masahiko Sawada for reporting this problem. (CVE-2026-19385)", "commit_aliases": ["13bb73aeb", "3299c2ba0", "3392cce5c", "57aa21f69", "71ba5705d", "86cd82bf4", "c2b16f5d4"], "source_commits": ["3299c2ba0"], "source_entry_id": "16.15/changes/021", "db_id": "dce6c62e738d4e4801ee4cb45757968f", "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b", "relations": [{"rule": 2, "type": "equivalent", "target": "5183659937548a24721c52721ce5656b", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}}, {"rule": 2, "type": "equivalent", "target": "63fc39b2fe0a2553fb195650ae6915cb", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}}, {"rule": 2, "type": "equivalent", "target": "6a0f92cad4fbbfe88adb2be733310a9b", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}}, {"rule": 2, "type": "equivalent", "target": "f91d32a8c03492afba6d7ba835690a32", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "f91d32a8c03492afba6d7ba835690a32", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}, "url": "/docs/compare/?release=18.6#18.6-d40f8de8e21a4c6f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "63fc39b2fe0a2553fb195650ae6915cb", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}, "url": "/docs/compare/?release=17.11#17.11-f6aaa44b60ea5479", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "5183659937548a24721c52721ce5656b", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}, "url": "/docs/compare/?release=15.19#15.19-fa846de81d1d3c18", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "6a0f92cad4fbbfe88adb2be733310a9b", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "evidence": {"same_day": true, "patch_ids": ["185500373cc27d3d610be991561eb522"], "statement_hash": "0503fb690855a4bf21f955b8b62af71583c422a4e69c4c228faea1f3e3f8b84b"}, "url": "/docs/compare/?release=14.24#14.24-f37e6003b995c6db", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-9465542088e662ad", "cves": ["CVE-2026-14670"], "html": "Harden PL/Perl against “tied” Perl arrays and hashes (Tom Lane) §
\nA tied object that doesn't behave like a regular one could lead to memory overwrite, or to constructing a corrupt result array (which would likely cause problems later).
\nThe PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14670)
", "text": "Harden PL/Perl against “tied” Perl arrays and hashes (Tom Lane) § A tied object that doesn't behave like a regular one could lead to memory overwrite, or to constructing a corrupt result array (which would likely cause problems later). The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14670)", "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "commits": ["477a6bdb0"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "21ddef80b75bee235c22b4b8c79638c7d0f3748d9ee5d895788119900bc3676d", "section_path": ["Changes"], "commit_groups": [["2d78c34f8", "477a6bdb0", "63cb15f40", "87c4b8219", "8c48cd615", "cf4ae7c3b", "d7fcfead3"]], "identity_text": "Harden PL/Perl against tied Perl arrays and hashes (Tom Lane) A tied object that doesn't behave like a regular one could lead to memory overwrite, or to constructing a corrupt result array (which would likely cause problems later). The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14670)", "commit_aliases": ["2d78c34f8", "477a6bdb0", "63cb15f40", "87c4b8219", "8c48cd615", "cf4ae7c3b", "d7fcfead3"], "source_commits": ["477a6bdb0"], "source_entry_id": "16.15/changes/022", "db_id": "0caaa5502645631a657b97dc78add8c0", "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0", "relations": [{"rule": 2, "type": "equivalent", "target": "45822fd5bc04f9bc7cd5310ebd922c61", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}}, {"rule": 2, "type": "equivalent", "target": "59a40e9cc2306d6e115d10b26c7b6d9e", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}}, {"rule": 2, "type": "equivalent", "target": "bd87bdc33bbf3c2a24631a385372b6ad", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}}, {"rule": 2, "type": "equivalent", "target": "f0c1fefb4fd60b97ad1a6420db84a85a", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "45822fd5bc04f9bc7cd5310ebd922c61", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}, "url": "/docs/compare/?release=18.6#18.6-6d183d795dd4fadd", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "59a40e9cc2306d6e115d10b26c7b6d9e", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}, "url": "/docs/compare/?release=17.11#17.11-58243a045a5d2555", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "bd87bdc33bbf3c2a24631a385372b6ad", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}, "url": "/docs/compare/?release=15.19#15.19-31838acd743ddb41", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f0c1fefb4fd60b97ad1a6420db84a85a", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "evidence": {"same_day": true, "patch_ids": ["5749c355b8bd5a5f2a0f8679d48902f9"], "statement_hash": "e681b36f925829491afb4aaf1536bea68f7b5021f6e0ea3fdb126ffd69367fa0"}, "url": "/docs/compare/?release=14.24#14.24-00b84c1b83bd3d6b", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-342fcd712e0eba5c", "cves": ["CVE-2026-14677", "CVE-2026-6473"], "html": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl (Heikki Linnakangas) §
\nThis is the same type of problem as CVE-2026-6473, just in a different part of the code, and is fixed in the same way.
\nThe PostgreSQL Project thanks the Tulya Project (Team Dhiutsa, Bitecope Technologies Private Ltd) for reporting this problem. (CVE-2026-14677)
", "text": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl (Heikki Linnakangas) § This is the same type of problem as CVE-2026-6473, just in a different part of the code, and is fixed in the same way. The PostgreSQL Project thanks the Tulya Project (Team Dhiutsa, Bitecope Technologies Private Ltd) for reporting this problem. (CVE-2026-14677)", "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "commits": ["8bbdc0540"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d40fe2326e4955d43f27b67c722e1c34286934d8b3e76ec6701d1c29164f9538", "section_path": ["Changes"], "commit_groups": [["028ee716a", "1eb0d5380", "776467301", "8bbdc0540", "a1c1727cb", "aff9dac1c", "b56cc7deb"]], "identity_text": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl (Heikki Linnakangas) This is the same type of problem as CVE-2026-6473, just in a different part of the code, and is fixed in the same way. The PostgreSQL Project thanks the Tulya Project (Team Dhiutsa, Bitecope Technologies Private Ltd) for reporting this problem. (CVE-2026-14677)", "commit_aliases": ["028ee716a", "1eb0d5380", "776467301", "8bbdc0540", "a1c1727cb", "aff9dac1c", "b56cc7deb"], "source_commits": ["8bbdc0540"], "source_entry_id": "16.15/changes/023", "db_id": "f5ff50e89bc960e1e5bac3249477b995", "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4", "relations": [{"rule": 2, "type": "equivalent", "target": "238a2ce678961ff0ad08154da3915f04", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}}, {"rule": 2, "type": "equivalent", "target": "4cc223998ff4d5b7cf50efd21e2284b1", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}}, {"rule": 2, "type": "equivalent", "target": "a110c06ad7fd7a9c4f063b051daf6836", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}}, {"rule": 2, "type": "equivalent", "target": "eaeb89e4752f46002fc91e3a83e9f683", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "238a2ce678961ff0ad08154da3915f04", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}, "url": "/docs/compare/?release=18.6#18.6-16cede7597f41368", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "a110c06ad7fd7a9c4f063b051daf6836", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}, "url": "/docs/compare/?release=17.11#17.11-7026dc1b76714418", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "4cc223998ff4d5b7cf50efd21e2284b1", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}, "url": "/docs/compare/?release=15.19#15.19-d03175b8e62ca77d", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "eaeb89e4752f46002fc91e3a83e9f683", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "evidence": {"same_day": true, "patch_ids": ["551a41f04d69f180135194c24f4907fb"], "statement_hash": "b56f55f83d652a2d7354185c8891454536092c27a727aecc0b21ea91949626f4"}, "url": "/docs/compare/?release=14.24#14.24-cbf179d0fe218ed0", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-20c54db9d1517bb1", "cves": ["CVE-2026-14673"], "html": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions (Noah Misch) §
Because amcheck will run such index expressions as the owner of their tables, a caller could potentially hijack search_path-dependent functions to run arbitrary code as the table owner. By default this is not a vulnerability because only superusers are allowed to call amcheck functions; but if that privilege was granted out, it created a larger hazard than the documentation suggests.
The PostgreSQL Project thanks Yuelin Wang and Jacob Brazeal for reporting this problem. (CVE-2026-14673)
", "text": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions (Noah Misch) § Because amcheck will run such index expressions as the owner of their tables, a caller could potentially hijack search_path-dependent functions to run arbitrary code as the table owner. By default this is not a vulnerability because only superusers are allowed to call amcheck functions; but if that privilege was granted out, it created a larger hazard than the documentation suggests. The PostgreSQL Project thanks Yuelin Wang and Jacob Brazeal for reporting this problem. (CVE-2026-14673)", "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "commits": ["2cc147318"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "ecfb582a42971962d8070f900dfe7b9ef3c0767dd1ffc7055f6f93237aa3efc4", "section_path": ["Changes"], "commit_groups": [["0a61fcde0", "0fbf785b1", "2cc147318", "39d792040", "557cc7186", "e41c72aff", "e43e74756"]], "identity_text": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions (Noah Misch) Because amcheck will run such index expressions as the owner of their tables, a caller could potentially hijack search_path-dependent functions to run arbitrary code as the table owner. By default this is not a vulnerability because only superusers are allowed to call amcheck functions; but if that privilege was granted out, it created a larger hazard than the documentation suggests. The PostgreSQL Project thanks Yuelin Wang and Jacob Brazeal for reporting this problem. (CVE-2026-14673)", "commit_aliases": ["0a61fcde0", "0fbf785b1", "2cc147318", "39d792040", "557cc7186", "e41c72aff", "e43e74756"], "source_commits": ["2cc147318"], "source_entry_id": "16.15/changes/024", "db_id": "465e8cabac386aa937b2b97c990e0a0f", "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6", "relations": [{"rule": 2, "type": "equivalent", "target": "2c238928eeda3326738ac133c3580936", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}}, {"rule": 2, "type": "equivalent", "target": "9ef4dc62946cbc0407d82f3a9b826f0e", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}}, {"rule": 2, "type": "equivalent", "target": "c016d6a0f320dafa02d0585b20842685", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}}, {"rule": 2, "type": "equivalent", "target": "cb5c4637df879fb88877a760ee0058f9", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "cb5c4637df879fb88877a760ee0058f9", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}, "url": "/docs/compare/?release=18.6#18.6-64ea1ee53902ffcc", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "2c238928eeda3326738ac133c3580936", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}, "url": "/docs/compare/?release=17.11#17.11-ee34ba8ba8f4fa3d", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "c016d6a0f320dafa02d0585b20842685", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}, "url": "/docs/compare/?release=15.19#15.19-ab72faa7677e5388", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "9ef4dc62946cbc0407d82f3a9b826f0e", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "evidence": {"same_day": true, "patch_ids": ["5c909624ee89c6ad2350bdeebaf3e414"], "statement_hash": "659077ecd2d4227788959afddf19d4e415449e3189a19ba0beb867937958bff6"}, "url": "/docs/compare/?release=14.24#14.24-e234967475d09d13", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-a51d10d5c2a5583d", "cves": ["CVE-2026-15742"], "html": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions (Nathan Bossart) §
Passing large cost values to these functions could cause integer overflows, thereby producing nonsensical results, and even causing out-of-bounds writes in some cases.
\nThe PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15742)
", "text": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions (Nathan Bossart) § Passing large cost values to these functions could cause integer overflows, thereby producing nonsensical results, and even causing out-of-bounds writes in some cases. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15742)", "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "commits": ["61481aa0e"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "3e9ac78640cb254f92d6b505e9fa8d22e094dfbbb548fb2af60e1e9783b79b18", "section_path": ["Changes"], "commit_groups": [["61481aa0e", "62c31b490", "74916136f", "918683d12", "9505175f2", "c4d51b627", "e88eb4e76"]], "identity_text": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions (Nathan Bossart) Passing large cost values to these functions could cause integer overflows, thereby producing nonsensical results, and even causing out-of-bounds writes in some cases. The PostgreSQL Project thanks Ben Morris (in collaboration with Claude and Anthropic Research) for reporting this problem. (CVE-2026-15742)", "commit_aliases": ["61481aa0e", "62c31b490", "74916136f", "918683d12", "9505175f2", "c4d51b627", "e88eb4e76"], "source_commits": ["61481aa0e"], "source_entry_id": "16.15/changes/025", "db_id": "bc23bdcfa3cae705ffa99474b3b97aae", "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5", "relations": [{"rule": 2, "type": "equivalent", "target": "1e5eda106e8fd11472d74f91bffc2ff0", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}}, {"rule": 2, "type": "equivalent", "target": "24d49d08ad8dddbb2e9b85283621ee67", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}}, {"rule": 2, "type": "equivalent", "target": "6cca8c3102c334bca04243a3114f48fe", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}}, {"rule": 2, "type": "equivalent", "target": "f41b59ba5bf8ae6184895fe8e7bb8dc1", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "1e5eda106e8fd11472d74f91bffc2ff0", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}, "url": "/docs/compare/?release=18.6#18.6-9f4c551d8e885121", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "6cca8c3102c334bca04243a3114f48fe", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}, "url": "/docs/compare/?release=17.11#17.11-8ee281616fb9fd49", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "f41b59ba5bf8ae6184895fe8e7bb8dc1", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}, "url": "/docs/compare/?release=15.19#15.19-45fb139f005bf72d", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "24d49d08ad8dddbb2e9b85283621ee67", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "evidence": {"same_day": true, "patch_ids": ["b6a4ec5efdc01505934fe024a8a4270f"], "statement_hash": "f6379cf73e457381cf432fa9add17bfe91f2d96391011c3fe8081ecbbd13eff5"}, "url": "/docs/compare/?release=14.24#14.24-249a71765a38f726", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-881f882c67a9948d", "cves": ["CVE-2026-14676"], "html": "Fix buffer overrun in contrib/pg_stat_statements (Álvaro Herrera)
Query normalization didn't accurately account for the amount of space the normalized string would require.
\nThe PostgreSQL Project thanks Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang for reporting this problem. (CVE-2026-14676)
", "text": "Fix buffer overrun in contrib/pg_stat_statements (Álvaro Herrera) Query normalization didn't accurately account for the amount of space the normalized string would require. The PostgreSQL Project thanks Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang for reporting this problem. (CVE-2026-14676)", "title": "Fix buffer overrun in contrib/pg_stat_statements", "commits": [], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "ca48f4077f77c6c16b1f3b54ed2340924f89b69f65b4efb2a69cd24757c7f56b", "section_path": ["Changes"], "commit_groups": [["1e2795dde", "8a31ffc2d", "bb02eba53"]], "identity_text": "Fix buffer overrun in contrib/pg_stat_statements (Álvaro Herrera) Query normalization didn't accurately account for the amount of space the normalized string would require. The PostgreSQL Project thanks Sajeeb Lohani (with TrendAI Zero Day Initiative) and Yuelin Wang for reporting this problem. (CVE-2026-14676)", "commit_aliases": ["1e2795dde", "8a31ffc2d", "bb02eba53"], "source_commits": ["1e2795dde"], "source_entry_id": "16.15/changes/026", "db_id": "d8f3c95effa66c9d7648ed329303a70e", "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22", "relations": [{"rule": 2, "type": "equivalent", "target": "29895bb80ed2951a21b387b1a32fd0bf", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}}, {"rule": 2, "type": "equivalent", "target": "aaa4509a01eb087a7c8dae3d3477599b", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}}, {"rule": 2, "type": "equivalent", "target": "d7011cf7f02dec0d6f5320d50f1060d7", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}}, {"rule": 2, "type": "equivalent", "target": "e84c1b71b1c15bae4e222a2f72d84864", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "e84c1b71b1c15bae4e222a2f72d84864", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix buffer overrun in contrib/pg_stat_statements", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}, "url": "/docs/compare/?release=18.6#18.6-c2bc95cc72b98750", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "d7011cf7f02dec0d6f5320d50f1060d7", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix buffer overrun in contrib/pg_stat_statements", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}, "url": "/docs/compare/?release=17.11#17.11-881f882c67a9948d", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "29895bb80ed2951a21b387b1a32fd0bf", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix buffer overrun in contrib/pg_stat_statements", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}, "url": "/docs/compare/?release=15.19#15.19-881f882c67a9948d", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "aaa4509a01eb087a7c8dae3d3477599b", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix buffer overrun in contrib/pg_stat_statements", "evidence": {"same_day": true, "patch_ids": ["ff92e3cbebc5005b0bef45f9f1d8d30a"], "statement_hash": "9ccd331655eef445554d4bf3ba5a781e3ca80ec62b9fce48b4cf6f7177789b22"}, "url": "/docs/compare/?release=14.24#14.24-881f882c67a9948d", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-0621542d439e129f", "cves": ["CVE-2026-14678"], "html": "Fix datatype error in contrib/pg_trgm's GiST picksplit function (Heikki Linnakangas) §
This mistake resulted in reading past the end of the buffer, typically causing bad split decisions; but a crash could ensue if you're very unlucky.
\nThe PostgreSQL Project thanks Mehmet D. Ince for reporting this problem. (CVE-2026-14678)
", "text": "Fix datatype error in contrib/pg_trgm's GiST picksplit function (Heikki Linnakangas) § This mistake resulted in reading past the end of the buffer, typically causing bad split decisions; but a crash could ensue if you're very unlucky. The PostgreSQL Project thanks Mehmet D. Ince for reporting this problem. (CVE-2026-14678)", "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "commits": ["24c88cd39"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "e9f156453aabaec8d98e34cb40923cb799504020277dc029844e75cdfb788ec5", "section_path": ["Changes"], "commit_groups": [["1af08af69", "24c88cd39", "66c2dbb20", "849019a50", "a74aa0854", "aa7b5815e", "c7c82a88c"]], "identity_text": "Fix datatype error in contrib/pg_trgm's GiST picksplit function (Heikki Linnakangas) This mistake resulted in reading past the end of the buffer, typically causing bad split decisions; but a crash could ensue if you're very unlucky. The PostgreSQL Project thanks Mehmet D. Ince for reporting this problem. (CVE-2026-14678)", "commit_aliases": ["1af08af69", "24c88cd39", "66c2dbb20", "849019a50", "a74aa0854", "aa7b5815e", "c7c82a88c"], "source_commits": ["24c88cd39"], "source_entry_id": "16.15/changes/027", "db_id": "1dcffcddaa3ea6a57ebf8bf560e8c531", "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474", "relations": [{"rule": 2, "type": "equivalent", "target": "007e7b20002c9154a7b78500dad11fde", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}}, {"rule": 2, "type": "equivalent", "target": "0bc10887e786dd035f4571e42ea848b8", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}}, {"rule": 2, "type": "equivalent", "target": "b9b08968a5deb7a55558cd0e3c3ecb91", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}}, {"rule": 2, "type": "equivalent", "target": "c1b223f3527ab1382981f7ea6931f7ec", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "0bc10887e786dd035f4571e42ea848b8", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}, "url": "/docs/compare/?release=18.6#18.6-b960de4f8267096f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "007e7b20002c9154a7b78500dad11fde", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}, "url": "/docs/compare/?release=17.11#17.11-caca197ce0ba4b3f", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b9b08968a5deb7a55558cd0e3c3ecb91", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}, "url": "/docs/compare/?release=15.19#15.19-057de36f6fc47ee3", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "c1b223f3527ab1382981f7ea6931f7ec", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "evidence": {"same_day": true, "patch_ids": ["e6003b6617841df26303992ba1215f03"], "statement_hash": "b75b9d4c297e71b80fedfe6eeb16417da2cd09f4baa7f5d2b7d3f4d2495f3474"}, "url": "/docs/compare/?release=14.24#14.24-76522194454c0c43", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-b2c274cdcaf4ba1b", "cves": ["CVE-2026-14671"], "html": "Remove the plan cache in contrib/refint (Ayush Tiwari) §
This caching behavior has several serious bugs, notably that check_foreign_key() embeds the new key values in its cascade-UPDATE queries, so a cached plan reuses the originally-needed values rather than the key values that should be used. The simplest solution is to remove it.
The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14671)
", "text": "Remove the plan cache in contrib/refint (Ayush Tiwari) § This caching behavior has several serious bugs, notably that check_foreign_key() embeds the new key values in its cascade-UPDATE queries, so a cached plan reuses the originally-needed values rather than the key values that should be used. The simplest solution is to remove it. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14671)", "title": "Remove the plan cache in contrib/refint", "commits": ["a572dd213"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "7e23eddfcde74cd1d0966e8d7261257f9c65988995b889a6722e8dde99f61b26", "section_path": ["Changes"], "commit_groups": [["1fbe2066d", "5b72d0279", "66a5146dc", "79a506228", "a572dd213", "b7b513d9a"]], "identity_text": "Remove the plan cache in contrib/refint (Ayush Tiwari) This caching behavior has several serious bugs, notably that check_foreign_key() embeds the new key values in its cascade-UPDATE queries, so a cached plan reuses the originally-needed values rather than the key values that should be used. The simplest solution is to remove it. The PostgreSQL Project thanks Hcamael for reporting this problem. (CVE-2026-14671)", "commit_aliases": ["1fbe2066d", "5b72d0279", "66a5146dc", "79a506228", "a572dd213", "b7b513d9a"], "source_commits": ["a572dd213"], "source_entry_id": "16.15/changes/028", "db_id": "ddbe7d30f92efca35dca583745e7a91a", "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9", "relations": [{"rule": 2, "type": "equivalent", "target": "0edf0fe6be4ddcafd5c7d27addaa918f", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}}, {"rule": 2, "type": "equivalent", "target": "139a1ada6baf2bae757b6a1a97ee7f41", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}}, {"rule": 2, "type": "equivalent", "target": "7dbe14e2bbf06d93dd90088eae989b60", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}}, {"rule": 2, "type": "equivalent", "target": "aca3bdc694388071f82dcc5eb7deb70d", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "139a1ada6baf2bae757b6a1a97ee7f41", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Remove the plan cache in contrib/refint", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}, "url": "/docs/compare/?release=18.6#18.6-2fe39251a9e1874e", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "aca3bdc694388071f82dcc5eb7deb70d", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Remove the plan cache in contrib/refint", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}, "url": "/docs/compare/?release=17.11#17.11-9677b8014f265a17", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "0edf0fe6be4ddcafd5c7d27addaa918f", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Remove the plan cache in contrib/refint", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}, "url": "/docs/compare/?release=15.19#15.19-cf70552f3d82a213", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "7dbe14e2bbf06d93dd90088eae989b60", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Remove the plan cache in contrib/refint", "evidence": {"same_day": true, "patch_ids": ["1a32666836cb434aea5b3cbd8282c9f7"], "statement_hash": "b8e6fe77ce440b33c793882e33b84a13458e57df19432239a74f731dbb6496f9"}, "url": "/docs/compare/?release=14.24#14.24-80251253da1ccc96", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-edc0d9fdf44f08e4", "cves": [], "html": "Fix self-deadlock when replaying WAL generated by an older minor version (Andrey Borodin) §
\nThis error was introduced in the previous set of minor releases. It caused standby servers that were following a primary of an older minor release version to get stuck in some scenarios.
", "text": "Fix self-deadlock when replaying WAL generated by an older minor version (Andrey Borodin) § This error was introduced in the previous set of minor releases. It caused standby servers that were following a primary of an older minor release version to get stuck in some scenarios.", "title": "Fix self-deadlock when replaying WAL generated by an older minor version", "commits": ["42a3194e5"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d32f1d9421e9e8da6466fd5343be7b13766ba445b7fabdf92d4c40da128599e4", "section_path": ["Changes"], "commit_groups": [["2bb60eb4f", "2dfe75f98", "42a3194e5"]], "identity_text": "Fix self-deadlock when replaying WAL generated by an older minor version (Andrey Borodin) This error was introduced in the previous set of minor releases. It caused standby servers that were following a primary of an older minor release version to get stuck in some scenarios.", "commit_aliases": ["2bb60eb4f", "2dfe75f98", "42a3194e5"], "source_commits": ["42a3194e5"], "source_entry_id": "16.15/changes/029", "db_id": "84ce4daf734d18a70c460556862b1365", "patch_ids": ["391bc973cdca4b3d1a27beb999ce9ebe"], "statement_hash": "3690951e53a3f75de59c1b0018e637bfa23861de52ca307aa4d0888a917fa4fb", "relations": [{"rule": 2, "type": "equivalent", "target": "eb42e5aa2e27518ec6a03155135fe29e", "evidence": {"same_day": true, "patch_ids": ["391bc973cdca4b3d1a27beb999ce9ebe"], "statement_hash": "3690951e53a3f75de59c1b0018e637bfa23861de52ca307aa4d0888a917fa4fb"}}, {"rule": 2, "type": "equivalent", "target": "f9e47f65a5de6643777c00ef8a224814", "evidence": {"same_day": true, "patch_ids": ["391bc973cdca4b3d1a27beb999ce9ebe"], "statement_hash": "3690951e53a3f75de59c1b0018e637bfa23861de52ca307aa4d0888a917fa4fb"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "f9e47f65a5de6643777c00ef8a224814", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix self-deadlock when replaying WAL generated by an older minor version", "evidence": {"same_day": true, "patch_ids": ["391bc973cdca4b3d1a27beb999ce9ebe"], "statement_hash": "3690951e53a3f75de59c1b0018e637bfa23861de52ca307aa4d0888a917fa4fb"}, "url": "/docs/compare/?release=15.19#15.19-3c293c0013973f80", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "eb42e5aa2e27518ec6a03155135fe29e", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix self-deadlock when replaying WAL generated by an older minor version", "evidence": {"same_day": true, "patch_ids": ["391bc973cdca4b3d1a27beb999ce9ebe"], "statement_hash": "3690951e53a3f75de59c1b0018e637bfa23861de52ca307aa4d0888a917fa4fb"}, "url": "/docs/compare/?release=14.24#14.24-b04257b41ad2b97e", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-726d3c037f7a5f67", "cves": [], "html": "Fix mis-handling of asynchronous reads when rescanning an asynchronous Append plan node (Alexander Korotkov, Gleb Kashkin, Etsuro Fujita) §
\nWhen an upper plan node rescans an Append before having read the entire Append output, we need to discard any in-flight requests sent to external servers (by postgres_fdw for example). This was not done correctly in cases where a subplan has parameter changes or is discarded by partition pruning in the next scan. The outcome could be incorrect query results, an infinite loop, or an assertion failure.
Fix error in partition pruning for RANGE-partitioned tables (David Rowley) §
\nIn some cases the DEFAULT partition would be skipped when it should not be, which could lead to rows missing from query results.
", "text": "Fix error in partition pruning for RANGE-partitioned tables (David Rowley) § In some cases the DEFAULT partition would be skipped when it should not be, which could lead to rows missing from query results.", "title": "Fix error in partition pruning for RANGE-partitioned tables", "commits": ["9a0cd8e73"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "1bcfc789390e2c87603b3937037174ecb767838434b982b7091cc5831b0a3a6a", "section_path": ["Changes"], "commit_groups": [["02e69be47", "31f2acde5", "5190732c9", "6098f35f4", "709dfd27f", "9a0cd8e73", "f9282a650"]], "identity_text": "Fix error in partition pruning for RANGE-partitioned tables (David Rowley) In some cases the DEFAULT partition would be skipped when it should not be, which could lead to rows missing from query results.", "commit_aliases": ["02e69be47", "31f2acde5", "5190732c9", "6098f35f4", "709dfd27f", "9a0cd8e73", "f9282a650"], "source_commits": ["9a0cd8e73"], "source_entry_id": "16.15/changes/031", "db_id": "b1408f66d7e290909c80f8c2b9d6a6e6", "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23", "relations": [{"rule": 2, "type": "equivalent", "target": "128f5b0ef464d5fb3f9f8de9b62b5b0c", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}}, {"rule": 2, "type": "equivalent", "target": "199c05dd5ca242a1207113d841920d91", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}}, {"rule": 2, "type": "equivalent", "target": "8e616a25980e478e4ba1d40fd43361c9", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}}, {"rule": 2, "type": "equivalent", "target": "c03487e8eed72def14469f629495faba", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "128f5b0ef464d5fb3f9f8de9b62b5b0c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix error in partition pruning for RANGE-partitioned tables", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}, "url": "/docs/compare/?release=18.6#18.6-1c1bf5522234d430", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "199c05dd5ca242a1207113d841920d91", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix error in partition pruning for RANGE-partitioned tables", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}, "url": "/docs/compare/?release=17.11#17.11-ae4f5cd546a7dc28", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "8e616a25980e478e4ba1d40fd43361c9", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix error in partition pruning for RANGE-partitioned tables", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}, "url": "/docs/compare/?release=15.19#15.19-b3f92b81dd82f323", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "c03487e8eed72def14469f629495faba", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix error in partition pruning for RANGE-partitioned tables", "evidence": {"same_day": true, "patch_ids": ["07f80c898c23577b927785baf5699ba6"], "statement_hash": "e3e0e32dc70a802e15316cd723301dfb9165a361cfaaa3eaebb6138320570c23"}, "url": "/docs/compare/?release=14.24#14.24-b6f407b6d50bed97", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-fa8b871fcf656789", "cves": [], "html": "Fix planner's nullability and strictness checks for value IN (array)
These checks should only succeed if the array operand is known to be non-empty, but that consideration was missed, allowing optimizations to be applied that should not be. This could result in wrong query answers if the array actually was empty.
", "text": "Fix planner's nullability and strictness checks for value IN (array) expressions (Ayush Tiwari) § These checks should only succeed if the array operand is known to be non-empty, but that consideration was missed, allowing optimizations to be applied that should not be. This could result in wrong query answers if the array actually was empty.", "title": "Fix planner's nullability and strictness checks for value IN (array) expressions", "commits": ["6fcee189b"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "862166901984937aff0f852d22f55f3df9d8d493c51819cce3483a5e112bd18d", "section_path": ["Changes"], "commit_groups": [["13b627a3e", "239eabda4", "26d6b7dc9", "277122036", "53470ffba", "6fcee189b", "9740c68ff"]], "identity_text": "Fix planner's nullability and strictness checks for value IN (array) expressions (Ayush Tiwari) These checks should only succeed if the array operand is known to be non-empty, but that consideration was missed, allowing optimizations to be applied that should not be. This could result in wrong query answers if the array actually was empty.", "commit_aliases": ["13b627a3e", "239eabda4", "26d6b7dc9", "277122036", "53470ffba", "6fcee189b", "9740c68ff"], "source_commits": ["6fcee189b"], "source_entry_id": "16.15/changes/032", "db_id": "c4e4aedd211ab9a3cebe71bab9209dff", "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25", "relations": [{"rule": 2, "type": "equivalent", "target": "295b1a7da9077453b2e0fd1899e5c7e4", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}}, {"rule": 2, "type": "equivalent", "target": "53fcc801e2a78a55196f6122abbd7a01", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}}, {"rule": 2, "type": "equivalent", "target": "8c22785dc1e64a0a8f07acd08ee8695d", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}}, {"rule": 2, "type": "equivalent", "target": "ad3ee3744d12ed87e41b743df908a973", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "ad3ee3744d12ed87e41b743df908a973", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix planner's nullability and strictness checks for value IN (array) expressions", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}, "url": "/docs/compare/?release=18.6#18.6-7f07d942a2dc7fb3", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "53fcc801e2a78a55196f6122abbd7a01", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix planner's nullability and strictness checks for value IN (array) expressions", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}, "url": "/docs/compare/?release=17.11#17.11-0179d9549f7c629e", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "8c22785dc1e64a0a8f07acd08ee8695d", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix planner's nullability and strictness checks for value IN (array) expressions", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}, "url": "/docs/compare/?release=15.19#15.19-6f626d9b6541c108", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "295b1a7da9077453b2e0fd1899e5c7e4", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix planner's nullability and strictness checks for value IN (array) expressions", "evidence": {"same_day": true, "patch_ids": ["df435503db83a1e14391340c77582135"], "statement_hash": "2d92bc3cfa84bb56afc5d1f1b3a42de958d5476b1ad5c8eeac46ecc8e878ca25"}, "url": "/docs/compare/?release=14.24#14.24-1f1442421fcf2295", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-dbc5e51d45a37594", "cves": [], "html": "Fix incorrect join removal logic (Matheus Alcantara, Richard Guo) § §
\nIn edge cases, it was possible for a constant output value coming from within the nullable side of an outer join to not be replaced by NULL when it should be.
", "text": "Fix incorrect join removal logic (Matheus Alcantara, Richard Guo) § § In edge cases, it was possible for a constant output value coming from within the nullable side of an outer join to not be replaced by NULL when it should be.", "title": "Fix incorrect join removal logic", "commits": ["3e1fe25e6", "d610d8e8b"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "6eae96ce944fa543bfb65c02e1937ac0980912a9eaee304c50600bb24c05311e", "section_path": ["Changes"], "commit_groups": [["0da71d90d", "72457f1df", "9e40d07e1", "b308eb366", "d610d8e8b"], ["1df9e8d96", "21f5e659e", "3e1fe25e6", "8bc479627", "cdcec567d"]], "identity_text": "Fix incorrect join removal logic (Matheus Alcantara, Richard Guo) In edge cases, it was possible for a constant output value coming from within the nullable side of an outer join to not be replaced by NULL when it should be.", "commit_aliases": ["0da71d90d", "1df9e8d96", "21f5e659e", "3e1fe25e6", "72457f1df", "8bc479627", "9e40d07e1", "b308eb366", "cdcec567d", "d610d8e8b"], "source_commits": ["3e1fe25e6", "d610d8e8b"], "source_entry_id": "16.15/changes/033", "db_id": "86a9304ee897d487f2f08fdf6cd5a298", "patch_ids": ["1e12745a4a72c22047b3d9e8c13b8fb6", "dabc0be4437bfea2c9473e4b0cbd7ede"], "statement_hash": "66372d30c157ceb2f0f88f6e5275d315accebe006eebab6de4089f55d7597b5d", "relations": [{"rule": 2, "type": "equivalent", "target": "4f181419572dec31c7f8a0612a21f555", "evidence": {"same_day": true, "patch_ids": ["1e12745a4a72c22047b3d9e8c13b8fb6", "dabc0be4437bfea2c9473e4b0cbd7ede"], "statement_hash": "66372d30c157ceb2f0f88f6e5275d315accebe006eebab6de4089f55d7597b5d"}}, {"rule": 2, "type": "equivalent", "target": "d46715d5dbb4902eaecdcfe45967fd74", "evidence": {"same_day": true, "patch_ids": ["1e12745a4a72c22047b3d9e8c13b8fb6", "dabc0be4437bfea2c9473e4b0cbd7ede"], "statement_hash": "66372d30c157ceb2f0f88f6e5275d315accebe006eebab6de4089f55d7597b5d"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "4f181419572dec31c7f8a0612a21f555", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix incorrect join removal logic", "evidence": {"same_day": true, "patch_ids": ["1e12745a4a72c22047b3d9e8c13b8fb6", "dabc0be4437bfea2c9473e4b0cbd7ede"], "statement_hash": "66372d30c157ceb2f0f88f6e5275d315accebe006eebab6de4089f55d7597b5d"}, "url": "/docs/compare/?release=18.6#18.6-8445b59319518d4d", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "d46715d5dbb4902eaecdcfe45967fd74", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix incorrect join removal logic", "evidence": {"same_day": true, "patch_ids": ["1e12745a4a72c22047b3d9e8c13b8fb6", "dabc0be4437bfea2c9473e4b0cbd7ede"], "statement_hash": "66372d30c157ceb2f0f88f6e5275d315accebe006eebab6de4089f55d7597b5d"}, "url": "/docs/compare/?release=17.11#17.11-8ac984b046b9e22d", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-0fac2f9a99aa0191", "cves": [], "html": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges) (Andrei Lepikhov, Tom Lane) §
\nThe planner must verify hashability of the container's component type(s) before deciding it can use a hash-based plan type. This step was missed in some places, leading to “could not identify a hash function” failures at execution.
", "text": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges) (Andrei Lepikhov, Tom Lane) § The planner must verify hashability of the container's component type(s) before deciding it can use a hash-based plan type. This step was missed in some places, leading to “could not identify a hash function” failures at execution.", "title": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges)", "commits": ["cf2bfe073"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d5c175676e6bac063c4ff8b0eff36e04ddd154eae689dce09662bf2d30c03141", "section_path": ["Changes"], "commit_groups": [["06e94eccf", "11aed8d19", "19152e3c2", "64778fac7", "caebac5f1", "cf2bfe073"]], "identity_text": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges) (Andrei Lepikhov, Tom Lane) The planner must verify hashability of the container's component type(s) before deciding it can use a hash-based plan type. This step was missed in some places, leading to could not identify a hash function failures at execution.", "commit_aliases": ["06e94eccf", "11aed8d19", "19152e3c2", "64778fac7", "caebac5f1", "cf2bfe073"], "source_commits": ["cf2bfe073"], "source_entry_id": "16.15/changes/034", "db_id": "f09d5370fd92cd8394d32a7c6a39f808", "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9", "relations": [{"rule": 2, "type": "equivalent", "target": "4de85f9df67410e6ee11d61a4934c2dd", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}}, {"rule": 2, "type": "equivalent", "target": "8f291081d50c65368eaa75ffccbfb916", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}}, {"rule": 2, "type": "equivalent", "target": "b401153415d6c7495b085ccde803a0bc", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}}, {"rule": 2, "type": "equivalent", "target": "f1ae81ec65ad7eceb75ed5e3e0b2c543", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "b401153415d6c7495b085ccde803a0bc", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges)", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}, "url": "/docs/compare/?release=18.6#18.6-7bb42265442bdc48", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "4de85f9df67410e6ee11d61a4934c2dd", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges)", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}, "url": "/docs/compare/?release=17.11#17.11-f6f35a5c24f27bf2", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "8f291081d50c65368eaa75ffccbfb916", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges)", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}, "url": "/docs/compare/?release=15.19#15.19-af11d749ae05b88c", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f1ae81ec65ad7eceb75ed5e3e0b2c543", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Add missed checks for hashability of equality comparisons on container datatypes (arrays, composites, ranges)", "evidence": {"same_day": true, "patch_ids": ["f162e2041e91d006f552b603fcf44b0b"], "statement_hash": "b7a7a5b48bc59370b10583c89b44b2318a828907126bcf1f7993377c9815a9e9"}, "url": "/docs/compare/?release=14.24#14.24-16597bc3e22164d9", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-771e23308af7ee5f", "cves": [], "html": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY (Chengpeng Yan, David Rowley) §
These window functions were treated as monotonic when they should not be, allowing wrong answers to be computed.
", "text": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY (Chengpeng Yan, David Rowley) § These window functions were treated as monotonic when they should not be, allowing wrong answers to be computed.", "title": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY", "commits": ["a85732162"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "db53e80eb59359ad4c007ddb0c64cccbeb25a43ce12a717543975ca8036f79ea", "section_path": ["Changes"], "commit_groups": [["842e34efa", "a85732162", "be63b285e", "cf184ec77", "d007800f0", "fcd58c6d9"]], "identity_text": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY (Chengpeng Yan, David Rowley) These window functions were treated as monotonic when they should not be, allowing wrong answers to be computed.", "commit_aliases": ["842e34efa", "a85732162", "be63b285e", "cf184ec77", "d007800f0", "fcd58c6d9"], "source_commits": ["a85732162"], "source_entry_id": "16.15/changes/035", "db_id": "f36b3896971ebb704e9049fa9035f582", "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3", "relations": [{"rule": 2, "type": "equivalent", "target": "28c2612bebf05e287b83343abb5a649a", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}}, {"rule": 2, "type": "equivalent", "target": "40a7c9c1b0ba3bb62e973869e4377d48", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}}, {"rule": 2, "type": "equivalent", "target": "ddf83605232b0de3c591e0caa7a88605", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "ddf83605232b0de3c591e0caa7a88605", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}, "url": "/docs/compare/?release=18.6#18.6-88417491cf3856e5", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "40a7c9c1b0ba3bb62e973869e4377d48", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}, "url": "/docs/compare/?release=17.11#17.11-c7bededba93f5fa4", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "28c2612bebf05e287b83343abb5a649a", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix mis-optimization of COUNT window functions that have an EXCLUDE clause or lack ORDER BY", "evidence": {"same_day": true, "patch_ids": ["28e51714721f6a824be654de7f6357bc"], "statement_hash": "6285e56236281de47720490e02f655ef1c492df7841c118242cef65b8c828aa3"}, "url": "/docs/compare/?release=15.19#15.19-b8bb580eb8de14f5", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}]}, {"id": "16.15-91ab80f8ca5d7d2a", "cves": [], "html": "Fix ALTER COLUMN ... DROP EXPRESSION to work when there are multiple levels of partitions (Alberto Piai) §
Disallow renaming a rule to _RETURN (Tom Lane) §
That name is reserved for a view's ON SELECT rule, but ALTER RULE allowed renaming other rules to _RETURN, causing trouble later.
Fix missing lock release for role membership grants in DROP OWNED BY (Jeff Davis) §
This oversight resulted in a warning message, followed by retaining a lock on the membership grant until the end of the transaction.
", "text": "Fix missing lock release for role membership grants in DROP OWNED BY (Jeff Davis) § This oversight resulted in a warning message, followed by retaining a lock on the membership grant until the end of the transaction.", "title": "Fix missing lock release for role membership grants in DROP OWNED BY", "commits": ["e61d44fde"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "bc7ae0543f09a3ec382addddfa4b0dd583233c661febea63b542b471ed0bb8e4", "section_path": ["Changes"], "commit_groups": [["25e54cec7", "9eccdae22", "a0daa0b41", "b48caa7df", "e61d44fde"]], "identity_text": "Fix missing lock release for role membership grants in DROP OWNED BY (Jeff Davis) This oversight resulted in a warning message, followed by retaining a lock on the membership grant until the end of the transaction.", "commit_aliases": ["25e54cec7", "9eccdae22", "a0daa0b41", "b48caa7df", "e61d44fde"], "source_commits": ["e61d44fde"], "source_entry_id": "16.15/changes/038", "db_id": "0563a596791449f44372e96193722ea2", "patch_ids": ["366a54c27360ab3839f71c858dc847c7"], "statement_hash": "c3d8dda4db627322e27465f2a355faabf29a98b7c4ddfd870cf46d4fa9b704f9", "relations": [{"rule": 2, "type": "equivalent", "target": "5ac990e6d8ae4f5c9facf9044c23d6c9", "evidence": {"same_day": true, "patch_ids": ["366a54c27360ab3839f71c858dc847c7"], "statement_hash": "c3d8dda4db627322e27465f2a355faabf29a98b7c4ddfd870cf46d4fa9b704f9"}}, {"rule": 2, "type": "equivalent", "target": "f38a9d64af080b972d55091afa2b7167", "evidence": {"same_day": true, "patch_ids": ["366a54c27360ab3839f71c858dc847c7"], "statement_hash": "c3d8dda4db627322e27465f2a355faabf29a98b7c4ddfd870cf46d4fa9b704f9"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "5ac990e6d8ae4f5c9facf9044c23d6c9", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix missing lock release for role membership grants in DROP OWNED BY", "evidence": {"same_day": true, "patch_ids": ["366a54c27360ab3839f71c858dc847c7"], "statement_hash": "c3d8dda4db627322e27465f2a355faabf29a98b7c4ddfd870cf46d4fa9b704f9"}, "url": "/docs/compare/?release=18.6#18.6-b6f7587292fb4dc6", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "f38a9d64af080b972d55091afa2b7167", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix missing lock release for role membership grants in DROP OWNED BY", "evidence": {"same_day": true, "patch_ids": ["366a54c27360ab3839f71c858dc847c7"], "statement_hash": "c3d8dda4db627322e27465f2a355faabf29a98b7c4ddfd870cf46d4fa9b704f9"}, "url": "/docs/compare/?release=17.11#17.11-3e140cc33315fc88", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-355171a4f97e88f7", "cves": [], "html": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates (Richard Guo) §
Some plan structures resulted in “invalid JsonConstructorExpr underlying node type” errors.
", "text": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates (Richard Guo) § Some plan structures resulted in “invalid JsonConstructorExpr underlying node type” errors.", "title": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates", "commits": ["485527190"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "437397458a2b605c59c162600a18e9e0b61605738f1f146e88bf35c55e72297e", "section_path": ["Changes"], "commit_groups": [["45364e496", "485527190", "96ab9a990", "dcda1f07d", "eaa561fb6"]], "identity_text": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates (Richard Guo) Some plan structures resulted in invalid JsonConstructorExpr underlying node type errors.", "commit_aliases": ["45364e496", "485527190", "96ab9a990", "dcda1f07d", "eaa561fb6"], "source_commits": ["485527190"], "source_entry_id": "16.15/changes/039", "db_id": "9796917e37d7742de7735ae20dbc9e8c", "patch_ids": ["60000a6e62ddc3ae0c3b7ef80802ee71"], "statement_hash": "6a7283c8b92d0663e05728d26d406516f01a522c2433821f328a072f69e8d6c2", "relations": [{"rule": 2, "type": "equivalent", "target": "76da1bf58091a36c27ddeecb07c72440", "evidence": {"same_day": true, "patch_ids": ["60000a6e62ddc3ae0c3b7ef80802ee71"], "statement_hash": "6a7283c8b92d0663e05728d26d406516f01a522c2433821f328a072f69e8d6c2"}}, {"rule": 2, "type": "equivalent", "target": "9bd2c80a3ef9ebab0fa8c15b085cb9d4", "evidence": {"same_day": true, "patch_ids": ["60000a6e62ddc3ae0c3b7ef80802ee71"], "statement_hash": "6a7283c8b92d0663e05728d26d406516f01a522c2433821f328a072f69e8d6c2"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "9bd2c80a3ef9ebab0fa8c15b085cb9d4", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates", "evidence": {"same_day": true, "patch_ids": ["60000a6e62ddc3ae0c3b7ef80802ee71"], "statement_hash": "6a7283c8b92d0663e05728d26d406516f01a522c2433821f328a072f69e8d6c2"}, "url": "/docs/compare/?release=18.6#18.6-604b807a12c59a87", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "76da1bf58091a36c27ddeecb07c72440", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix failure of EXPLAIN when deparsing SQL/JSON aggregates", "evidence": {"same_day": true, "patch_ids": ["60000a6e62ddc3ae0c3b7ef80802ee71"], "statement_hash": "6a7283c8b92d0663e05728d26d406516f01a522c2433821f328a072f69e8d6c2"}, "url": "/docs/compare/?release=17.11#17.11-df483e133aa49926", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-1b1cda18e768032a", "cves": [], "html": "Fix use of REINDEX CONCURRENTLY with a deferred uniqueness constraint (Nitin Motiani) §
The transient index copy created during REINDEX CONCURRENTLY was incorrectly marked as enforcing immediate uniqueness, causing spurious reports of constraint violation.
Fix matching of localized month/day names in to_date() (Heikki Linnakangas) §
The matching logic misbehaved in cases where case-folding changes the byte length of the string.
", "text": "Fix matching of localized month/day names in to_date() (Heikki Linnakangas) § The matching logic misbehaved in cases where case-folding changes the byte length of the string.", "title": "Fix matching of localized month/day names in to_date()", "commits": ["b594efe52"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "ebd4130dd29cec092d75d1bb3122e1e554ca6c6630d93793913cdce9866e8e68", "section_path": ["Changes"], "commit_groups": [["011384ba4", "0de744cd5", "49a712f32", "55ea76426", "8acfaa12a", "b594efe52", "fd2b89854"]], "identity_text": "Fix matching of localized month/day names in to_date() (Heikki Linnakangas) The matching logic misbehaved in cases where case-folding changes the byte length of the string.", "commit_aliases": ["011384ba4", "0de744cd5", "49a712f32", "55ea76426", "8acfaa12a", "b594efe52", "fd2b89854"], "source_commits": ["b594efe52"], "source_entry_id": "16.15/changes/041", "db_id": "08bd69e7cd8f7b8bd4623958f924ac19", "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da", "relations": [{"rule": 2, "type": "equivalent", "target": "0800233346f3a252c62d9a6f579d5573", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}}, {"rule": 2, "type": "equivalent", "target": "b0d8986fede0f1216361d5a43a076e4e", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}}, {"rule": 2, "type": "equivalent", "target": "d3800c6695b429dd746c574f0d0d93e5", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}}, {"rule": 2, "type": "related", "target": "eb74da46a95f0db0c15adface2feaffa", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "eb74da46a95f0db0c15adface2feaffa", "kind": "related", "version": "18.6", "label": "18.6", "title": "Fix matching of localized month/day names in to_date()", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}, "url": "/docs/compare/?release=18.6#18.6-937d0b3149314116", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "b0d8986fede0f1216361d5a43a076e4e", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix matching of localized month/day names in to_date()", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}, "url": "/docs/compare/?release=17.11#17.11-8557fc5fb2204540", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "0800233346f3a252c62d9a6f579d5573", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix matching of localized month/day names in to_date()", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}, "url": "/docs/compare/?release=15.19#15.19-a96cc8b4c22ffe2e", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "d3800c6695b429dd746c574f0d0d93e5", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix matching of localized month/day names in to_date()", "evidence": {"same_day": true, "patch_ids": ["b8ca654311e23485845960b9d01e76fc"], "statement_hash": "ef6d4c6554fba5da9f815beec3f0b6e84e2334ba9bd093035db08b8e3c61e1da"}, "url": "/docs/compare/?release=14.24#14.24-8ab3e783a00643a8", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-b06391696fc6a94f", "cves": [], "html": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE) (Diego Frias, Michael Paquier) §
\nThis character was treated as a valid T syllable, which it is not, and hence silently swallowed during normalization.
", "text": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE) (Diego Frias, Michael Paquier) § This character was treated as a valid T syllable, which it is not, and hence silently swallowed during normalization.", "title": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)", "commits": ["82116023e"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "af0c4f1ef5e1d0d7577e75047cf8285663fc432a7717fca5696c94b76ff7742d", "section_path": ["Changes"], "commit_groups": [["0c9cbbfb5", "273fe9485", "82116023e", "8bb935d61", "c391375ba", "f2ff15e4c"]], "identity_text": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE) (Diego Frias, Michael Paquier) This character was treated as a valid T syllable, which it is not, and hence silently swallowed during normalization.", "commit_aliases": ["0c9cbbfb5", "273fe9485", "82116023e", "8bb935d61", "c391375ba", "f2ff15e4c"], "source_commits": ["82116023e"], "source_entry_id": "16.15/changes/042", "db_id": "b4da21230a332d29b7fdd0c30e5eb1b0", "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717", "relations": [{"rule": 2, "type": "equivalent", "target": "3a6050c2cb2fe8b496eaa4963a657d6a", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}}, {"rule": 2, "type": "equivalent", "target": "3ca62c531cc3952831a57b828ba3be6f", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}}, {"rule": 2, "type": "equivalent", "target": "955b29dab0dd740875781e1df1992bdc", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}}, {"rule": 2, "type": "equivalent", "target": "aaef9ba320136440f8b0a3ec12c67f23", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "3a6050c2cb2fe8b496eaa4963a657d6a", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}, "url": "/docs/compare/?release=18.6#18.6-bad72301bf213a01", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "955b29dab0dd740875781e1df1992bdc", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}, "url": "/docs/compare/?release=17.11#17.11-ed1426e8e931d4ba", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "aaef9ba320136440f8b0a3ec12c67f23", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}, "url": "/docs/compare/?release=15.19#15.19-dab67300bc6bbe1f", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "3ca62c531cc3952831a57b828ba3be6f", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix incorrect NFC recomposition for Hangul U+11A7 (TBASE)", "evidence": {"same_day": true, "patch_ids": ["725250db9eb55dab240d380ece2a835b"], "statement_hash": "0790cf6e3b0bbc225a449fee5cfdf5d70b4c6b23cc6777393156d83479c1c717"}, "url": "/docs/compare/?release=14.24#14.24-68c56e11fd51d378", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-2163d6f45ee0d876", "cves": [], "html": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries (Jeff Davis) §
If folding to lower case increased the byte length of a lexeme, it was incorrectly truncated to its original byte length when emitted.
", "text": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries (Jeff Davis) § If folding to lower case increased the byte length of a lexeme, it was incorrectly truncated to its original byte length when emitted.", "title": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries", "commits": ["b32df590c"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d002ca454a0821615616fb719a3f767a7dfa1b1907037ba47b22f14a0ec1827b", "section_path": ["Changes"], "commit_groups": [["1e0458172", "3805641cb", "89e648498", "9234e3337", "a7e0e42a2", "b32df590c"]], "identity_text": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries (Jeff Davis) If folding to lower case increased the byte length of a lexeme, it was incorrectly truncated to its original byte length when emitted.", "commit_aliases": ["1e0458172", "3805641cb", "89e648498", "9234e3337", "a7e0e42a2", "b32df590c"], "source_commits": ["b32df590c"], "source_entry_id": "16.15/changes/043", "db_id": "ae43518b0809db4841928b42a3de5142", "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3", "relations": [{"rule": 2, "type": "equivalent", "target": "0633548b5897af860062f0da29c48e44", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}}, {"rule": 2, "type": "equivalent", "target": "347d8e16786f9262348eddb4e4ab7132", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}}, {"rule": 2, "type": "equivalent", "target": "3af409a2d71c7fbd1a45975cdba31ea0", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}}, {"rule": 2, "type": "equivalent", "target": "a4a88f042e4bc74a3646ee98fc6e3a95", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "347d8e16786f9262348eddb4e4ab7132", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}, "url": "/docs/compare/?release=18.6#18.6-3c978527782bcd11", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "a4a88f042e4bc74a3646ee98fc6e3a95", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}, "url": "/docs/compare/?release=17.11#17.11-a4695342e5fc0fc7", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "0633548b5897af860062f0da29c48e44", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}, "url": "/docs/compare/?release=15.19#15.19-28d4f1c94a8ecc1a", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "3af409a2d71c7fbd1a45975cdba31ea0", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Avoid possible truncation of output lexemes in case-insensitive synonym dictionaries", "evidence": {"same_day": true, "patch_ids": ["751e547292fa99c95c843d27d6c9593a"], "statement_hash": "c66911e6e36c7126e1b585143d9e9b87d38db4e29cfb38c6987eff4e2c4f70d3"}, "url": "/docs/compare/?release=14.24#14.24-c33079f2a44ffdbd", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-cb201ae319eda4b5", "cves": [], "html": "Fix typo in hash_record_extended() (Man Zeng) §
The code failed to initialize the second isnull argument passed to FunctionCallInvoke(). This is harmless for existing in-core extended hash support functions, which will not examine that value. However, extension-provided hash functions could be affected if they inspect PG_ARGISNULL(1).
Fix pg_get_publication_tables() to not fail if a publishable table is dropped concurrently (Bharath Rupireddy) §
Prevent satisfies_hash_partition() from crashing with VARIADIC NULL (Robert Haas) §
Report invalid-weight errors more cleanly and consistently in tsvector_filter() and allied functions (Ewan Young) §
In particular, report weight characters that are not printable ASCII in octal form (\\), as nnncharout() would render them. This avoids possibly producing an invalidly-encoded error message.
Fix mishandling of namespace nodes in xpath() (Michael Paquier) § §
This fix avoids an unexpected “could not copy node” error.
", "text": "Fix mishandling of namespace nodes in xpath() (Michael Paquier) § § This fix avoids an unexpected “could not copy node” error.", "title": "Fix mishandling of namespace nodes in xpath()", "commits": ["174076601", "fac26fd41"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "22cb860fe0d28653d5f2c9ebb541d6179ed36acb281e128bc9a9610431b577f4", "section_path": ["Changes"], "commit_groups": [["0b74df66f", "0d145be2c", "940916549", "9618e790c", "a17f39aa2", "fac26fd41"], ["174076601", "1d8c72b2e", "41876c8d7", "4c777d6dd", "6c08cbb7a", "8bf257aeb"]], "identity_text": "Fix mishandling of namespace nodes in xpath() (Michael Paquier) This fix avoids an unexpected could not copy node error.", "commit_aliases": ["0b74df66f", "0d145be2c", "174076601", "1d8c72b2e", "41876c8d7", "4c777d6dd", "6c08cbb7a", "8bf257aeb", "940916549", "9618e790c", "a17f39aa2", "fac26fd41"], "source_commits": ["174076601", "fac26fd41"], "source_entry_id": "16.15/changes/048", "db_id": "da05c3ee44af186be3d4b5b7c6f0afe4", "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37", "relations": [{"rule": 2, "type": "equivalent", "target": "9d61a6c023f441c2a3883f44804564ca", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}}, {"rule": 2, "type": "equivalent", "target": "a3cd7c73a5609ef9df5a2f2035307742", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}}, {"rule": 2, "type": "equivalent", "target": "c9299f10a2be68af64d82e072893d1fa", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}}, {"rule": 2, "type": "equivalent", "target": "d35a51c2f2bcdba360c287240fa92b7a", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "9d61a6c023f441c2a3883f44804564ca", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix mishandling of namespace nodes in xpath()", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}, "url": "/docs/compare/?release=18.6#18.6-a9563797105c5be3", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "a3cd7c73a5609ef9df5a2f2035307742", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix mishandling of namespace nodes in xpath()", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}, "url": "/docs/compare/?release=17.11#17.11-aea52062a31be5cf", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "c9299f10a2be68af64d82e072893d1fa", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix mishandling of namespace nodes in xpath()", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}, "url": "/docs/compare/?release=15.19#15.19-4ef656410724db83", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "d35a51c2f2bcdba360c287240fa92b7a", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix mishandling of namespace nodes in xpath()", "evidence": {"same_day": true, "patch_ids": ["702367d070cdeca227ba0e4197a518e9", "7df9ed5e8663765f5ca836c89d33f03d"], "statement_hash": "2ab954d63190bf0ecdc409c287a734a5049667a3d9db9dc5337f82a35275db37"}, "url": "/docs/compare/?release=14.24#14.24-c7c54909a4e7d896", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-547a8e38738139c4", "cves": [], "html": "Treat an undefined jsonpath variable as an error even when no variables are supplied (Andrey Rachitskiy) §
\nThe jsonb @? and @@ operators cannot supply any variables to be used in their jsonpath expressions. This code path erroneously treated an unknown jsonpath variable as a JSON null, rather than raising an error as expected. Aside from not being the expected behavior, this mistake could result in unbounded memory consumption.
Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text (Ayush Tiwari) §
There are no such data types in core PostgreSQL, but the problem is reachable with some extension types.
", "text": "Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text (Ayush Tiwari) § There are no such data types in core PostgreSQL, but the problem is reachable with some extension types.", "title": "Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text", "commits": ["60abb3c73"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "95e35932dd6034a5cfb0e495af59bd0f0d5e9a65119e97fbda095a47ead2deba", "section_path": ["Changes"], "commit_groups": [["35d9a6263", "60abb3c73", "7dd153259", "d0acd2535"]], "identity_text": "Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text (Ayush Tiwari) There are no such data types in core PostgreSQL, but the problem is reachable with some extension types.", "commit_aliases": ["35d9a6263", "60abb3c73", "7dd153259", "d0acd2535"], "source_commits": ["60abb3c73"], "source_entry_id": "16.15/changes/050", "db_id": "f8921df2d66db8b26d617c27bddf1db2", "patch_ids": ["96b46719db446e88ef3c60d115404730"], "statement_hash": "ea987d289e305c0b161cfa39b9d0169ba382dac0fa72d5593a7a281f289b9a70", "relations": [{"rule": 2, "type": "equivalent", "target": "2fbf45f00e42445fcae00d71cbf1f0dc", "evidence": {"same_day": true, "patch_ids": ["96b46719db446e88ef3c60d115404730"], "statement_hash": "ea987d289e305c0b161cfa39b9d0169ba382dac0fa72d5593a7a281f289b9a70"}}, {"rule": 2, "type": "equivalent", "target": "79cd8a83e8bf1bc35f530164bf6860b4", "evidence": {"same_day": true, "patch_ids": ["96b46719db446e88ef3c60d115404730"], "statement_hash": "ea987d289e305c0b161cfa39b9d0169ba382dac0fa72d5593a7a281f289b9a70"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "2fbf45f00e42445fcae00d71cbf1f0dc", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text", "evidence": {"same_day": true, "patch_ids": ["96b46719db446e88ef3c60d115404730"], "statement_hash": "ea987d289e305c0b161cfa39b9d0169ba382dac0fa72d5593a7a281f289b9a70"}, "url": "/docs/compare/?release=18.6#18.6-2abf51fa81b5fec1", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "79cd8a83e8bf1bc35f530164bf6860b4", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix NULL-pointer crash when IS JSON or similar constructs have an argument that is of string category but lacks a cast to type text", "evidence": {"same_day": true, "patch_ids": ["96b46719db446e88ef3c60d115404730"], "statement_hash": "ea987d289e305c0b161cfa39b9d0169ba382dac0fa72d5593a7a281f289b9a70"}, "url": "/docs/compare/?release=17.11#17.11-b72bd4ebdcd34344", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-f8110322fae804b5", "cves": [], "html": "Avoid machine-dependent behavior when dividing the smallest possible money value by -1 (Andrey Rachitskiy) §
Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary (Tom Lane) §
", "text": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary (Tom Lane) §", "title": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary", "commits": ["83336e3ed"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "957d2d1f7024cae2f78331db692d0f8ac5e7dcbf63c76ef88a1b989c28e06556", "section_path": ["Changes"], "commit_groups": [["025228104", "4e68b7e29", "634a8dcb8", "81b1e7916", "83336e3ed", "dda622edc", "df8407d7d"]], "identity_text": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary (Tom Lane)", "commit_aliases": ["025228104", "4e68b7e29", "634a8dcb8", "81b1e7916", "83336e3ed", "dda622edc", "df8407d7d"], "source_commits": ["83336e3ed"], "source_entry_id": "16.15/changes/052", "db_id": "7df44ef8cf990bb0e618cec50c164949", "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2", "relations": [{"rule": 2, "type": "equivalent", "target": "0c1ad5d57b9bccac58da6089309d8ba7", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}}, {"rule": 2, "type": "equivalent", "target": "b0c7268f189c5a8d74b8439d4bc7c5d9", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}}, {"rule": 2, "type": "equivalent", "target": "b1fc0de5d2d692ed4af6bcafccb53961", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}}, {"rule": 2, "type": "equivalent", "target": "c02824b6af588491530569e4ec99fe1c", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "c02824b6af588491530569e4ec99fe1c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}, "url": "/docs/compare/?release=18.6#18.6-8f91828547f09bb4", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "b1fc0de5d2d692ed4af6bcafccb53961", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}, "url": "/docs/compare/?release=17.11#17.11-84e7ed3f45fec194", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b0c7268f189c5a8d74b8439d4bc7c5d9", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}, "url": "/docs/compare/?release=15.19#15.19-a430cbb8698c9246", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "0c1ad5d57b9bccac58da6089309d8ba7", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix crash after out-of-memory failure partway through creation of a cache entry for a text search dictionary", "evidence": {"same_day": true, "patch_ids": ["3c3b45b5ca2c2212b9a36ad4558d619a"], "statement_hash": "bba5519e5078b4a32c843646cda9fbb9119cc591d67acb786924d35be185c1e2"}, "url": "/docs/compare/?release=14.24#14.24-f3e3230fd7374279", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-9a0f56094a25e9db", "cves": [], "html": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files (Andrey Rachitskiy) §
", "text": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files (Andrey Rachitskiy) §", "title": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files", "commits": ["444038bb7"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "0cdb9518d100550150a099e8a2be7048f5d5da7bb9d5f0ee4a218a3951873839", "section_path": ["Changes"], "commit_groups": [["0fb88979b", "330a72052", "3fe4062cc", "444038bb7", "4689ea9ce", "5fdea3aa3", "cfc720ef4"]], "identity_text": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files (Andrey Rachitskiy)", "commit_aliases": ["0fb88979b", "330a72052", "3fe4062cc", "444038bb7", "4689ea9ce", "5fdea3aa3", "cfc720ef4"], "source_commits": ["444038bb7"], "source_entry_id": "16.15/changes/053", "db_id": "77ab5557c03ca1e42e47d51eb237608a", "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944", "relations": [{"rule": 2, "type": "equivalent", "target": "5e12745b9a23fea83bd8ffdb594c44cb", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}}, {"rule": 2, "type": "equivalent", "target": "704f65f60aac8a5ed9ba34cc041d5717", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}}, {"rule": 2, "type": "equivalent", "target": "764e3f0a6b15565637fa481647bae444", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}}, {"rule": 2, "type": "equivalent", "target": "bff681fe60683158629758d3a37c8488", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "704f65f60aac8a5ed9ba34cc041d5717", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}, "url": "/docs/compare/?release=18.6#18.6-df42fd80a3fef364", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "5e12745b9a23fea83bd8ffdb594c44cb", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}, "url": "/docs/compare/?release=17.11#17.11-ce317c73e36b1b1b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "bff681fe60683158629758d3a37c8488", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}, "url": "/docs/compare/?release=15.19#15.19-12f2c81d2dc1af7f", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "764e3f0a6b15565637fa481647bae444", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix memory-safety bugs in processing of incorrect ispell/hunspell dictionary files", "evidence": {"same_day": true, "patch_ids": ["a2481aa7491246722b292cb1e96c16e2"], "statement_hash": "188f51f4de54b27a68f6be9927610ed299c71a8aed01714563e401acac778944"}, "url": "/docs/compare/?release=14.24#14.24-88bcd2945f60cd6c", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-3199fbb2e1d23f9b", "cves": [], "html": "Prevent access to other sessions' temporary tables (Jim Jones, Daniil Davydov, Alexander Korotkov) §
\nSome code paths failed to prevent this, leading to silently wrong (inconsistent) results.
", "text": "Prevent access to other sessions' temporary tables (Jim Jones, Daniil Davydov, Alexander Korotkov) § Some code paths failed to prevent this, leading to silently wrong (inconsistent) results.", "title": "Prevent access to other sessions' temporary tables", "commits": ["cc3fe7e2a"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d0c60594463b425a1a6292b2b48b18433d3073496395f44443fcffe6c594253f", "section_path": ["Changes"], "commit_groups": [["1b0dd0815", "4dfae59a1", "ce146621f"], ["3aaefe892", "4e49f68b7", "8021cdceb", "c40819ebf", "cc3fe7e2a"]], "identity_text": "Prevent access to other sessions' temporary tables (Jim Jones, Daniil Davydov, Alexander Korotkov) Some code paths failed to prevent this, leading to silently wrong (inconsistent) results.", "commit_aliases": ["1b0dd0815", "3aaefe892", "4dfae59a1", "4e49f68b7", "8021cdceb", "c40819ebf", "cc3fe7e2a", "ce146621f"], "source_commits": ["cc3fe7e2a", "ce146621f"], "source_entry_id": "16.15/changes/054", "db_id": "c23432cdcb396cd3d3ed58612faea4e6", "patch_ids": ["05c640bb8e2093f6ab8c82eace31d407", "78047299bcd9d41b99e91dfc8ff6128f"], "statement_hash": "bfbfb8f49eb1b9a9eeed9932c828c7ac49f313cc1b97070b91d77b3a11bb80b3", "relations": [{"rule": 2, "type": "equivalent", "target": "2b3bc99c3e3caa8f2f62effa65bfd425", "evidence": {"same_day": true, "patch_ids": ["05c640bb8e2093f6ab8c82eace31d407", "78047299bcd9d41b99e91dfc8ff6128f"], "statement_hash": "bfbfb8f49eb1b9a9eeed9932c828c7ac49f313cc1b97070b91d77b3a11bb80b3"}}, {"rule": 2, "type": "equivalent", "target": "446bb0cc48d437fdbe5c1c4d4b77a47b", "evidence": {"same_day": true, "patch_ids": ["05c640bb8e2093f6ab8c82eace31d407", "78047299bcd9d41b99e91dfc8ff6128f"], "statement_hash": "bfbfb8f49eb1b9a9eeed9932c828c7ac49f313cc1b97070b91d77b3a11bb80b3"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "2b3bc99c3e3caa8f2f62effa65bfd425", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Prevent access to other sessions' temporary tables", "evidence": {"same_day": true, "patch_ids": ["05c640bb8e2093f6ab8c82eace31d407", "78047299bcd9d41b99e91dfc8ff6128f"], "statement_hash": "bfbfb8f49eb1b9a9eeed9932c828c7ac49f313cc1b97070b91d77b3a11bb80b3"}, "url": "/docs/compare/?release=18.6#18.6-90e78edb7a08a279", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "446bb0cc48d437fdbe5c1c4d4b77a47b", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Prevent access to other sessions' temporary tables", "evidence": {"same_day": true, "patch_ids": ["05c640bb8e2093f6ab8c82eace31d407", "78047299bcd9d41b99e91dfc8ff6128f"], "statement_hash": "bfbfb8f49eb1b9a9eeed9932c828c7ac49f313cc1b97070b91d77b3a11bb80b3"}, "url": "/docs/compare/?release=17.11#17.11-712f69030e2d06d3", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-554df1ef2961c27f", "cves": [], "html": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup (Paul Kim, Alexander Korotkov) §
\nThe posting tree for a common value can be large, so that this missed check could allow vacuum to run for a long time before noticing an interrupt.
", "text": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup (Paul Kim, Alexander Korotkov) § The posting tree for a common value can be large, so that this missed check could allow vacuum to run for a long time before noticing an interrupt.", "title": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup", "commits": ["006ac761e"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "c3c690d86c071024e654eb432efbd3a8ba0c22702b8df8fa246023b974ff6688", "section_path": ["Changes"], "commit_groups": [["006ac761e", "15fd7a3e2", "70dad584e", "7123abab7", "7becb647d", "8a045f760", "ba5e46329"]], "identity_text": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup (Paul Kim, Alexander Korotkov) The posting tree for a common value can be large, so that this missed check could allow vacuum to run for a long time before noticing an interrupt.", "commit_aliases": ["006ac761e", "15fd7a3e2", "70dad584e", "7123abab7", "7becb647d", "8a045f760", "ba5e46329"], "source_commits": ["006ac761e"], "source_entry_id": "16.15/changes/055", "db_id": "409fe91bb94144927c72c3c45b46a6de", "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b", "relations": [{"rule": 2, "type": "equivalent", "target": "49ebdb578d55efc3f72704dda719fc23", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}}, {"rule": 2, "type": "equivalent", "target": "5ae3f0e86d0ce40099b20e708d75c4df", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}}, {"rule": 2, "type": "equivalent", "target": "814dbd746257f327d953bc1cef61300f", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}}, {"rule": 2, "type": "equivalent", "target": "95dd23cd66ca5f13741dbc751bd94f78", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "5ae3f0e86d0ce40099b20e708d75c4df", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}, "url": "/docs/compare/?release=18.6#18.6-06642c9e897515be", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "95dd23cd66ca5f13741dbc751bd94f78", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}, "url": "/docs/compare/?release=17.11#17.11-69bd1a00ee81086e", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "49ebdb578d55efc3f72704dda719fc23", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}, "url": "/docs/compare/?release=15.19#15.19-8a26ce7d87732222", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "814dbd746257f327d953bc1cef61300f", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Honor query cancel and vacuum delay during GIN index posting-tree cleanup", "evidence": {"same_day": true, "patch_ids": ["5737ead0e5ff1d380903a73cc5289899"], "statement_hash": "dbe0ee194244f00d3dbdcf97c73698ed65ff34b62bead922d8670ce2d3ad820b"}, "url": "/docs/compare/?release=14.24#14.24-25f9d07b0fe76365", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-54c08a28fecc0079", "cves": [], "html": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans (Peter Geoghegan) §
\nThis error could lead to emitting corrupted data from an index-only scan plan. The only affected core opclass is GiST's range_ops, and it could only fail if the range column were not the first index column.
", "text": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans (Peter Geoghegan) § This error could lead to emitting corrupted data from an index-only scan plan. The only affected core opclass is GiST's range_ops, and it could only fail if the range column were not the first index column.", "title": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans", "commits": ["e58192546"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "a9bf6c3a37347d95825654feeed30221fdac41ecf05cdd5286dea6f8fc16e7b4", "section_path": ["Changes"], "commit_groups": [["126141425", "1d4c81ad6", "355faed5a", "959b7fa2c", "c9ea37231", "e4ad22eb0", "e58192546"]], "identity_text": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans (Peter Geoghegan) This error could lead to emitting corrupted data from an index-only scan plan. The only affected core opclass is GiST's range_ops, and it could only fail if the range column were not the first index column.", "commit_aliases": ["126141425", "1d4c81ad6", "355faed5a", "959b7fa2c", "c9ea37231", "e4ad22eb0", "e58192546"], "source_commits": ["e58192546"], "source_entry_id": "16.15/changes/056", "db_id": "fcb9ed65e8420a852359f3e3f6bd54b4", "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5", "relations": [{"rule": 2, "type": "equivalent", "target": "14d92270ba44127134ec95d6dc3f7106", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}}, {"rule": 2, "type": "equivalent", "target": "65fae97c05ec4b526543f385b077725a", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}}, {"rule": 2, "type": "equivalent", "target": "7639c43a8df152827beb0f3c4e7cfc7b", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}}, {"rule": 2, "type": "equivalent", "target": "ae38912b977aee6ba812c2a99322b4ad", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "ae38912b977aee6ba812c2a99322b4ad", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}, "url": "/docs/compare/?release=18.6#18.6-5a9e09abedfed179", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "7639c43a8df152827beb0f3c4e7cfc7b", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}, "url": "/docs/compare/?release=17.11#17.11-7b0787620962198f", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "65fae97c05ec4b526543f385b077725a", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}, "url": "/docs/compare/?release=15.19#15.19-05c8adba23ea9473", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "14d92270ba44127134ec95d6dc3f7106", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix possible mis-decoding of index tuples during GiST and SP-GiST index-only scans", "evidence": {"same_day": true, "patch_ids": ["7ca370d11dfae190ad9f8fa921a2ad3d"], "statement_hash": "9efc8088134be1c1e73efd8706fe30257c8c7003aa683976e4455f175426f7c5"}, "url": "/docs/compare/?release=14.24#14.24-1210849badf0243c", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-5b769a1a41d683e2", "cves": [], "html": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly (Jingtang Zhang) §
\nAn off-by-one error caused the last block of a multi-block table extension to not be marked as free in the map. This would eventually get corrected by vacuum, but meanwhile the space wouldn't be used.
", "text": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly (Jingtang Zhang) § An off-by-one error caused the last block of a multi-block table extension to not be marked as free in the map. This would eventually get corrected by vacuum, but meanwhile the space wouldn't be used.", "title": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly", "commits": ["0fd5595aa"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "85833534cf8d295ffec262aea966dcabc98a3c0ba6d1073e94734fb0fcaf9097", "section_path": ["Changes"], "commit_groups": [["0fd5595aa", "768ae083e", "7a103928a", "a2fd8d65a", "eabc9a9dd"]], "identity_text": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly (Jingtang Zhang) An off-by-one error caused the last block of a multi-block table extension to not be marked as free in the map. This would eventually get corrected by vacuum, but meanwhile the space wouldn't be used.", "commit_aliases": ["0fd5595aa", "768ae083e", "7a103928a", "a2fd8d65a", "eabc9a9dd"], "source_commits": ["0fd5595aa"], "source_entry_id": "16.15/changes/057", "db_id": "21d26afc1e7bfcc375bff059f0b216d1", "patch_ids": ["a01b2fa451eb1e57f308131966fdbfa3"], "statement_hash": "86a67f4007c63f314fcd3fa59706655774d99e6653a04f11b106c0666d4ea725", "relations": [{"rule": 2, "type": "equivalent", "target": "5a75bdb8448ae2da9b4ee0c1b6cfc0ec", "evidence": {"same_day": true, "patch_ids": ["a01b2fa451eb1e57f308131966fdbfa3"], "statement_hash": "86a67f4007c63f314fcd3fa59706655774d99e6653a04f11b106c0666d4ea725"}}, {"rule": 2, "type": "equivalent", "target": "edf9c4cb86d4f9c68eb8b2fe8ad0b5d1", "evidence": {"same_day": true, "patch_ids": ["a01b2fa451eb1e57f308131966fdbfa3"], "statement_hash": "86a67f4007c63f314fcd3fa59706655774d99e6653a04f11b106c0666d4ea725"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "edf9c4cb86d4f9c68eb8b2fe8ad0b5d1", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly", "evidence": {"same_day": true, "patch_ids": ["a01b2fa451eb1e57f308131966fdbfa3"], "statement_hash": "86a67f4007c63f314fcd3fa59706655774d99e6653a04f11b106c0666d4ea725"}, "url": "/docs/compare/?release=18.6#18.6-27ff2778a5384e11", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "5a75bdb8448ae2da9b4ee0c1b6cfc0ec", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Ensure that the new last block of a bulk-extended table is added to its free space map promptly", "evidence": {"same_day": true, "patch_ids": ["a01b2fa451eb1e57f308131966fdbfa3"], "statement_hash": "86a67f4007c63f314fcd3fa59706655774d99e6653a04f11b106c0666d4ea725"}, "url": "/docs/compare/?release=17.11#17.11-3992304d0ec9fe22", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-560dbc4a06a156a7", "cves": [], "html": "When creating directories, tolerate concurrent creation of the same directory (Andrew Dunstan, Tom Lane) §
", "text": "When creating directories, tolerate concurrent creation of the same directory (Andrew Dunstan, Tom Lane) §", "title": "When creating directories, tolerate concurrent creation of the same directory", "commits": ["9951e3d38"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "3abd2d655a622d7c5016c8b296b5075431f5e81fcce8522f9b1c52bc63a75ae0", "section_path": ["Changes"], "commit_groups": [["4647ac142", "4b3bc6b71", "9951e3d38", "aa80c34c8", "f0a831ef3", "f25a07b2d"]], "identity_text": "When creating directories, tolerate concurrent creation of the same directory (Andrew Dunstan, Tom Lane)", "commit_aliases": ["4647ac142", "4b3bc6b71", "9951e3d38", "aa80c34c8", "f0a831ef3", "f25a07b2d"], "source_commits": ["9951e3d38"], "source_entry_id": "16.15/changes/058", "db_id": "467be2f83ba0b7e841b7fca2b8c0a0af", "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb", "relations": [{"rule": 2, "type": "equivalent", "target": "0c17e02f698dc60a4c3ff762796f0a7f", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}}, {"rule": 2, "type": "equivalent", "target": "268b9e4fbdc7682f30cd928e974932c2", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}}, {"rule": 2, "type": "equivalent", "target": "7b3923b1add1cfb8cc243430e7e7769f", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}}, {"rule": 2, "type": "equivalent", "target": "b3f796774144a4fd6c7ec84d799fce9c", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "7b3923b1add1cfb8cc243430e7e7769f", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "When creating directories, tolerate concurrent creation of the same directory", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}, "url": "/docs/compare/?release=18.6#18.6-67b85199c3f22fc0", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "0c17e02f698dc60a4c3ff762796f0a7f", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "When creating directories, tolerate concurrent creation of the same directory", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}, "url": "/docs/compare/?release=17.11#17.11-13269e0439b17ec9", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "268b9e4fbdc7682f30cd928e974932c2", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "When creating directories, tolerate concurrent creation of the same directory", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}, "url": "/docs/compare/?release=15.19#15.19-a8d34c2e8685a39c", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "b3f796774144a4fd6c7ec84d799fce9c", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "When creating directories, tolerate concurrent creation of the same directory", "evidence": {"same_day": true, "patch_ids": ["be8272a81c28ebdf12c66d1c6ab05685"], "statement_hash": "abc7e610f491a4ce631c4e62316b1f9bd718c7e9e581a2f07ba12774f5db10eb"}, "url": "/docs/compare/?release=14.24#14.24-2c65a57d05310508", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-c1d18953b262f630", "cves": [], "html": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on (Bertrand Drouvot) § §
\nThe shared lock will conflict with any attempt to drop the depended-on object, eliminating the race condition that formerly existed. For example, if one session drops a schema (that appears empty to it) concurrently with some other session creating a function in that schema, previously both transactions could commit, leaving an invalid function definition behind. Now, one transaction or the other will fail.
", "text": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on (Bertrand Drouvot) § § The shared lock will conflict with any attempt to drop the depended-on object, eliminating the race condition that formerly existed. For example, if one session drops a schema (that appears empty to it) concurrently with some other session creating a function in that schema, previously both transactions could commit, leaving an invalid function definition behind. Now, one transaction or the other will fail.", "title": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on", "commits": ["d44cd4674", "d9bc0d96c"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "7c506f1734b11cf86ca3604ab46ac62716a8b4b20a8c88f9c85685f923c1b9f6", "section_path": ["Changes"], "commit_groups": [["2fbb21170", "3a9909eda", "5100bdbd3", "5fa137727", "c8cd3d697", "d9bc0d96c"], ["36b6ed260", "c1588f92a", "d44cd4674", "ef3d7b15e", "f9d5a52da", "fd93ee100"]], "identity_text": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on (Bertrand Drouvot) The shared lock will conflict with any attempt to drop the depended-on object, eliminating the race condition that formerly existed. For example, if one session drops a schema (that appears empty to it) concurrently with some other session creating a function in that schema, previously both transactions could commit, leaving an invalid function definition behind. Now, one transaction or the other will fail.", "commit_aliases": ["2fbb21170", "36b6ed260", "3a9909eda", "5100bdbd3", "5fa137727", "c1588f92a", "c8cd3d697", "d44cd4674", "d9bc0d96c", "ef3d7b15e", "f9d5a52da", "fd93ee100"], "source_commits": ["d44cd4674", "d9bc0d96c"], "source_entry_id": "16.15/changes/059", "db_id": "e811cff0335c3ca435753578de40cbd3", "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c", "relations": [{"rule": 2, "type": "equivalent", "target": "744925e5c1491a9c1e34c5d45e2c5ffd", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}}, {"rule": 2, "type": "equivalent", "target": "a34abdf13c3a75b01325176fd494ce54", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}}, {"rule": 2, "type": "equivalent", "target": "a9f65b357e29d3c7c477cf734deef532", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}}, {"rule": 2, "type": "equivalent", "target": "e1119f78a9d166b823f798e0194d35f4", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "a34abdf13c3a75b01325176fd494ce54", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}, "url": "/docs/compare/?release=18.6#18.6-04ef095d0d14ee39", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "e1119f78a9d166b823f798e0194d35f4", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}, "url": "/docs/compare/?release=17.11#17.11-3ecac11b2752e81b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "744925e5c1491a9c1e34c5d45e2c5ffd", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}, "url": "/docs/compare/?release=15.19#15.19-f3cfe840091a64df", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "a9f65b357e29d3c7c477cf734deef532", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Prevent creation of dangling object dependencies by acquiring a shared lock on any object being depended on", "evidence": {"same_day": true, "patch_ids": ["6536cf91f14cf539ab4bd08602032b89", "aca7f5e76462423a64bce89519f8b4ca"], "statement_hash": "aabd3d9b6b1a0460624c086ca1a5f2223aec25bb342c2883b18a435de52ba98c"}, "url": "/docs/compare/?release=14.24#14.24-9b47dd97523d83ec", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-1a9b527727b160db", "cves": [], "html": "Fix race condition in conflict detection for SERIALIZABLE isolation mode (Peter Geoghegan) §
A conflict could be missed when examining an initially-empty btree index, allowing failure of serializability due to improperly allowing conflicting transactions to commit.
", "text": "Fix race condition in conflict detection for SERIALIZABLE isolation mode (Peter Geoghegan) § A conflict could be missed when examining an initially-empty btree index, allowing failure of serializability due to improperly allowing conflicting transactions to commit.", "title": "Fix race condition in conflict detection for SERIALIZABLE isolation mode", "commits": ["e321faaae"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "e4a4ab4545b57d288856f3522545ac6a8e90a7cac1c50aa1369b7de781b0c576", "section_path": ["Changes"], "commit_groups": [["2aa3c6d1f", "2fc3e1b44", "5d18105ca", "8434c9385", "ce3f19e26", "d560e730e", "e321faaae"]], "identity_text": "Fix race condition in conflict detection for SERIALIZABLE isolation mode (Peter Geoghegan) A conflict could be missed when examining an initially-empty btree index, allowing failure of serializability due to improperly allowing conflicting transactions to commit.", "commit_aliases": ["2aa3c6d1f", "2fc3e1b44", "5d18105ca", "8434c9385", "ce3f19e26", "d560e730e", "e321faaae"], "source_commits": ["e321faaae"], "source_entry_id": "16.15/changes/060", "db_id": "a69025df57e9873eeee634c6a24b5f52", "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297", "relations": [{"rule": 2, "type": "equivalent", "target": "03ed91689e7472f3e2b40c0668a9efe6", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}}, {"rule": 2, "type": "equivalent", "target": "06c841c7e97c29498c3c18507b648e43", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}}, {"rule": 2, "type": "equivalent", "target": "37ab9407c7a4720c042c3c30e616b840", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}}, {"rule": 2, "type": "equivalent", "target": "8911cf537e3c81e99f223106f705f385", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "37ab9407c7a4720c042c3c30e616b840", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix race condition in conflict detection for SERIALIZABLE isolation mode", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}, "url": "/docs/compare/?release=18.6#18.6-020cfc417a109d87", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "06c841c7e97c29498c3c18507b648e43", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix race condition in conflict detection for SERIALIZABLE isolation mode", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}, "url": "/docs/compare/?release=17.11#17.11-869506b0934d2991", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "8911cf537e3c81e99f223106f705f385", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix race condition in conflict detection for SERIALIZABLE isolation mode", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}, "url": "/docs/compare/?release=15.19#15.19-7ed1bdbb167b6fe1", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "03ed91689e7472f3e2b40c0668a9efe6", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix race condition in conflict detection for SERIALIZABLE isolation mode", "evidence": {"same_day": true, "patch_ids": ["76d6d81d4ce8e28654632817bbc18838"], "statement_hash": "08b20f0b0cc877fd90cf1664195b8bfe906cd38aa76d41fb6a77cbb2ead17297"}, "url": "/docs/compare/?release=14.24#14.24-62f053723972383a", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-c0c564a566bf9972", "cves": [], "html": "Fix race condition in ProcSignalBarrier code (Masahiko Sawada) §
\nThis error could result in processes getting stuck, typically after reporting “still waiting for backend with PID nnnn to accept ProcSignalBarrier”.
Fix race conditions when a set of processes that belong to the same lock group exit at the same time (Vlad Lesin) § §
\nThese errors could lead to PANIC aborts, with messages such as “latch already owned”. The issue does not normally arise in regular parallel query, since the leader won't exit before seeing its workers finish; but some extensions reach the problem.
", "text": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time (Vlad Lesin) § § These errors could lead to PANIC aborts, with messages such as “latch already owned”. The issue does not normally arise in regular parallel query, since the leader won't exit before seeing its workers finish; but some extensions reach the problem.", "title": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time", "commits": ["4e8edf53f", "65d04df60"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "1b3561d922cf9a9a9548820869d0e4af164878e1bf7c6198b78a84801252359a", "section_path": ["Changes"], "commit_groups": [["12c9b8b42", "4e8edf53f", "84b9d6bce", "db4d12fc9", "e14b4ea4a", "e786fb5aa"], ["563104523", "65d04df60", "8007d1185", "ae08eb168", "d489c4439", "d5cc6df60"]], "identity_text": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time (Vlad Lesin) These errors could lead to PANIC aborts, with messages such as latch already owned. The issue does not normally arise in regular parallel query, since the leader won't exit before seeing its workers finish; but some extensions reach the problem.", "commit_aliases": ["12c9b8b42", "4e8edf53f", "563104523", "65d04df60", "8007d1185", "84b9d6bce", "ae08eb168", "d489c4439", "d5cc6df60", "db4d12fc9", "e14b4ea4a", "e786fb5aa"], "source_commits": ["4e8edf53f", "65d04df60"], "source_entry_id": "16.15/changes/062", "db_id": "2c46dad30462775a825ad96cfb3ffbdf", "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592", "relations": [{"rule": 2, "type": "equivalent", "target": "5b2fc7485dc383d08b3d68f5272b2a11", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}}, {"rule": 2, "type": "equivalent", "target": "62cbccb23171427808fec1301b0ac804", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}}, {"rule": 2, "type": "equivalent", "target": "edd683109ce0095065cd3a04ab6b5136", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}}, {"rule": 2, "type": "equivalent", "target": "f2fcbfdff352b775c9b16fc62d0649b5", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "5b2fc7485dc383d08b3d68f5272b2a11", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}, "url": "/docs/compare/?release=18.6#18.6-25e5a2422482dd1c", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "62cbccb23171427808fec1301b0ac804", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}, "url": "/docs/compare/?release=17.11#17.11-31516fe59eede273", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "edd683109ce0095065cd3a04ab6b5136", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}, "url": "/docs/compare/?release=15.19#15.19-786c47066d87de68", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f2fcbfdff352b775c9b16fc62d0649b5", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix race conditions when a set of processes that belong to the same lock group exit at the same time", "evidence": {"same_day": true, "patch_ids": ["879e5bd994847bca2264dea6ae8e7636", "deebb0acfe2f0b111568661ecf5bdaeb"], "statement_hash": "8d70122ebcc8b017ec76eed632b4e53a2f4e86497efb77268f99f3855284c592"}, "url": "/docs/compare/?release=14.24#14.24-fc8ff9cc62311a3d", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-d4ff6572d90ae3ad", "cves": [], "html": "Fix race with timeline selection in logical decoding during standby promotion (Bertrand Drouvot) § § §
\nLogical decoding being performed on the standby could fail with a “requested WAL segment has already been removed” error. A repeat attempt would succeed, so there was no permanent problem but there was an availability hazard.
", "text": "Fix race with timeline selection in logical decoding during standby promotion (Bertrand Drouvot) § § § Logical decoding being performed on the standby could fail with a “requested WAL segment has already been removed” error. A repeat attempt would succeed, so there was no permanent problem but there was an availability hazard.", "title": "Fix race with timeline selection in logical decoding during standby promotion", "commits": ["2a04624da", "8cd687c44", "d9b49e5b4"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "940c68abf79b7684b3a70c0fb9169f9051ae6667203847d9d159676040e88d20", "section_path": ["Changes"], "commit_groups": [["16b89ff04", "8cd687c44", "b4bd13850", "eb4e7224a"], ["2a04624da", "4bff3aa51", "a8ee70bd5", "ab5334d8b"], ["d9b49e5b4"]], "identity_text": "Fix race with timeline selection in logical decoding during standby promotion (Bertrand Drouvot) Logical decoding being performed on the standby could fail with a requested WAL segment has already been removed error. A repeat attempt would succeed, so there was no permanent problem but there was an availability hazard.", "commit_aliases": ["16b89ff04", "2a04624da", "4bff3aa51", "8cd687c44", "a8ee70bd5", "ab5334d8b", "b4bd13850", "d9b49e5b4", "eb4e7224a"], "source_commits": ["2a04624da", "8cd687c44", "d9b49e5b4"], "source_entry_id": "16.15/changes/063", "db_id": "7c127c9b86c4ff620059a798b7b8dda9", "patch_ids": ["0baec0cbb6545813886061f478d7fe09", "1bbd3b28c72161d54ff8850fb5990a90", "afe572d50b5aa93a1a43ac975df96fa6"], "statement_hash": "b5c88f0e08517e3cf00dd9b3461ec817031530e9f8f05c2cde86c91f4ec8fc51", "relations": [{"rule": 2, "type": "equivalent", "target": "cfd9fb4fa936abb9c7ef216b4854fb3c", "evidence": {"same_day": true, "patch_ids": ["0baec0cbb6545813886061f478d7fe09", "1bbd3b28c72161d54ff8850fb5990a90", "afe572d50b5aa93a1a43ac975df96fa6"], "statement_hash": "b5c88f0e08517e3cf00dd9b3461ec817031530e9f8f05c2cde86c91f4ec8fc51"}}, {"rule": 2, "type": "equivalent", "target": "d6f8670170e47d169eec30b65187d2c4", "evidence": {"same_day": true, "patch_ids": ["0baec0cbb6545813886061f478d7fe09", "1bbd3b28c72161d54ff8850fb5990a90", "afe572d50b5aa93a1a43ac975df96fa6"], "statement_hash": "b5c88f0e08517e3cf00dd9b3461ec817031530e9f8f05c2cde86c91f4ec8fc51"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "cfd9fb4fa936abb9c7ef216b4854fb3c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix race with timeline selection in logical decoding during standby promotion", "evidence": {"same_day": true, "patch_ids": ["0baec0cbb6545813886061f478d7fe09", "1bbd3b28c72161d54ff8850fb5990a90", "afe572d50b5aa93a1a43ac975df96fa6"], "statement_hash": "b5c88f0e08517e3cf00dd9b3461ec817031530e9f8f05c2cde86c91f4ec8fc51"}, "url": "/docs/compare/?release=18.6#18.6-c988b88dbd957c88", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "d6f8670170e47d169eec30b65187d2c4", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix race with timeline selection in logical decoding during standby promotion", "evidence": {"same_day": true, "patch_ids": ["0baec0cbb6545813886061f478d7fe09", "1bbd3b28c72161d54ff8850fb5990a90", "afe572d50b5aa93a1a43ac975df96fa6"], "statement_hash": "b5c88f0e08517e3cf00dd9b3461ec817031530e9f8f05c2cde86c91f4ec8fc51"}, "url": "/docs/compare/?release=17.11#17.11-563becf7bc3e6dcf", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}]}, {"id": "16.15-90e616e97be2e9eb", "cves": [], "html": "Avoid exposing a WAL receiver's full connection string during timeline jumps (Chao Li) §
\nThe pg_stat_wal_receiver view should show a sanitized version of the connection string, without sensitive data. But it transiently showed the full string when we re-use an existing WAL receiver.
Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication (Varik Matevosyan) §
\nA malicious or buggy publisher could send inconsistent numbers of columns. While we could not find a scenario in which this would have serious ill effects, extra caution seems warranted.
", "text": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication (Varik Matevosyan) § A malicious or buggy publisher could send inconsistent numbers of columns. While we could not find a scenario in which this would have serious ill effects, extra caution seems warranted.", "title": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication", "commits": ["59759e1a5"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "ecd7124fbbaaaa7a6f78516878e98a4735bbc1fa84b2384211ba1f463063f90d", "section_path": ["Changes"], "commit_groups": [["15f4e3d0c", "510a05f07", "59759e1a5", "871d4f5b6", "bf7d19be9", "dc3db3a83"]], "identity_text": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication (Varik Matevosyan) A malicious or buggy publisher could send inconsistent numbers of columns. While we could not find a scenario in which this would have serious ill effects, extra caution seems warranted.", "commit_aliases": ["15f4e3d0c", "510a05f07", "59759e1a5", "871d4f5b6", "bf7d19be9", "dc3db3a83"], "source_commits": ["59759e1a5"], "source_entry_id": "16.15/changes/065", "db_id": "3d36fdfc273db605a521f97942cc7c8b", "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215", "relations": [{"rule": 2, "type": "equivalent", "target": "29b7d5b8d289c2e83357b4b3887c6ece", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}}, {"rule": 2, "type": "equivalent", "target": "2bec14054822093ac2f6b8e098cf50ef", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}}, {"rule": 2, "type": "equivalent", "target": "52499b2c374ab99a8520d4e208b224ca", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}}, {"rule": 2, "type": "equivalent", "target": "b984d160c74d462df46c0818a7351ddb", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "29b7d5b8d289c2e83357b4b3887c6ece", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}, "url": "/docs/compare/?release=18.6#18.6-842cc1f1f4a2405b", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "52499b2c374ab99a8520d4e208b224ca", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}, "url": "/docs/compare/?release=17.11#17.11-83651d53e036fd59", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b984d160c74d462df46c0818a7351ddb", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}, "url": "/docs/compare/?release=15.19#15.19-8e9a0447c93f98f9", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "2bec14054822093ac2f6b8e098cf50ef", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Use run-time checks, not just Asserts, to verify the correct number of columns in tuples received during logical replication", "evidence": {"same_day": true, "patch_ids": ["8665f0efb53857b1f65d3aab55fce701"], "statement_hash": "ccb9933f82e897841fcc7799b27c7cb46784658d50590f121d691ba4eb1ab215"}, "url": "/docs/compare/?release=14.24#14.24-09af4da1397bcb08", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-af8c105159d57f3b", "cves": [], "html": "Clean up quoting of string parameters within constructed replication commands (Tom Lane) §
\nVarious places that generate replication commands were not being adequately careful about quoting replication slot names and other parameters that need to be inserted into those commands. This could result in unexpected syntax errors in those commands. In principle, a crafted replication slot name could result in SQL injection; but such a scenario seems very unlikely to occur in practice, since replication operations can only be invoked by highly-privileged users and there is no reason for them to use a slot name coming from an untrustworthy source.
", "text": "Clean up quoting of string parameters within constructed replication commands (Tom Lane) § Various places that generate replication commands were not being adequately careful about quoting replication slot names and other parameters that need to be inserted into those commands. This could result in unexpected syntax errors in those commands. In principle, a crafted replication slot name could result in SQL injection; but such a scenario seems very unlikely to occur in practice, since replication operations can only be invoked by highly-privileged users and there is no reason for them to use a slot name coming from an untrustworthy source.", "title": "Clean up quoting of string parameters within constructed replication commands", "commits": ["26d6c19d0"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "dd223dff162b11067c9e52a54150ab156304fe409ea16a6d9eaf4ff87684837e", "section_path": ["Changes"], "commit_groups": [["14810cc0d", "26d6c19d0", "2a00840e8", "819e5b964", "a75bd485b", "abb582555"]], "identity_text": "Clean up quoting of string parameters within constructed replication commands (Tom Lane) Various places that generate replication commands were not being adequately careful about quoting replication slot names and other parameters that need to be inserted into those commands. This could result in unexpected syntax errors in those commands. In principle, a crafted replication slot name could result in SQL injection; but such a scenario seems very unlikely to occur in practice, since replication operations can only be invoked by highly-privileged users and there is no reason for them to use a slot name coming from an untrustworthy source.", "commit_aliases": ["14810cc0d", "26d6c19d0", "2a00840e8", "819e5b964", "a75bd485b", "abb582555"], "source_commits": ["26d6c19d0"], "source_entry_id": "16.15/changes/066", "db_id": "74c4a1b4a808ecb95dfae29020191080", "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa", "relations": [{"rule": 2, "type": "equivalent", "target": "1ef980c1780b85528850bbdd9466fa41", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}}, {"rule": 2, "type": "equivalent", "target": "492d74031b46a2dbdba89517c2392411", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}}, {"rule": 2, "type": "equivalent", "target": "54ed2b1cad03859f062c5ae13dc62693", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}}, {"rule": 2, "type": "equivalent", "target": "de678a747a30bf549de927b53ebbc3e7", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "1ef980c1780b85528850bbdd9466fa41", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Clean up quoting of string parameters within constructed replication commands", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}, "url": "/docs/compare/?release=18.6#18.6-9e33f830eed35c6f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "de678a747a30bf549de927b53ebbc3e7", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Clean up quoting of string parameters within constructed replication commands", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}, "url": "/docs/compare/?release=17.11#17.11-f6a7585b485a41e6", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "492d74031b46a2dbdba89517c2392411", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Clean up quoting of string parameters within constructed replication commands", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}, "url": "/docs/compare/?release=15.19#15.19-f46d264eacda5b12", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "54ed2b1cad03859f062c5ae13dc62693", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Clean up quoting of string parameters within constructed replication commands", "evidence": {"same_day": true, "patch_ids": ["32ecc5c79c988e036daa92766ab9c826"], "statement_hash": "247fbb71eedfaa36fb21d3377adab99beeefb9b4863ba98c464369fe5a6bc0fa"}, "url": "/docs/compare/?release=14.24#14.24-064a7da098f9ba6c", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-90c2bbc2eb6f8247", "cves": [], "html": "Fix logical decoding of empty prepared transactions (Masahiko Sawada) §
\nA prepared transaction that did not cause any decodable updates could result in sending COMMIT/ROLLBACK PREPARED to the output plugin with no preceding PREPARE. For the built-in subscriber this breaks replication, and other plugins will probably not like it either.
Fix corruption of unlogged sequences after standby promotion (Fujii Masao) §
\nPreviously, if an unlogged sequence was created on the primary and replicated to a standby, accessing the sequence after promoting the standby could fail with “bad magic number in sequence” or related errors.
", "text": "Fix corruption of unlogged sequences after standby promotion (Fujii Masao) § Previously, if an unlogged sequence was created on the primary and replicated to a standby, accessing the sequence after promoting the standby could fail with “bad magic number in sequence” or related errors.", "title": "Fix corruption of unlogged sequences after standby promotion", "commits": ["913d3b610"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "cae1eef428fecc87d40a65b72dd18fc24a15d3e6a768dca2193f895d7f4b39fc", "section_path": ["Changes"], "commit_groups": [["22af34b98", "627605713", "8e684ce11", "913d3b610", "a1ed6a9a0", "d2980067b"]], "identity_text": "Fix corruption of unlogged sequences after standby promotion (Fujii Masao) Previously, if an unlogged sequence was created on the primary and replicated to a standby, accessing the sequence after promoting the standby could fail with bad magic number in sequence or related errors.", "commit_aliases": ["22af34b98", "627605713", "8e684ce11", "913d3b610", "a1ed6a9a0", "d2980067b"], "source_commits": ["913d3b610"], "source_entry_id": "16.15/changes/068", "db_id": "1ce08b2128763f685c989c7f545e1b3e", "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462", "relations": [{"rule": 2, "type": "equivalent", "target": "04e99de2d6b9c7c2dbe0bac4e30b6b62", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}}, {"rule": 2, "type": "equivalent", "target": "7c75fcad7f434b0760cdb29e86f36c46", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}}, {"rule": 2, "type": "equivalent", "target": "ecc31612cc8e203d9211831d84c3f264", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "7c75fcad7f434b0760cdb29e86f36c46", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix corruption of unlogged sequences after standby promotion", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}, "url": "/docs/compare/?release=18.6#18.6-a4136eca0096397b", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "04e99de2d6b9c7c2dbe0bac4e30b6b62", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix corruption of unlogged sequences after standby promotion", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}, "url": "/docs/compare/?release=17.11#17.11-bbdd9aa8c76021bc", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "ecc31612cc8e203d9211831d84c3f264", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix corruption of unlogged sequences after standby promotion", "evidence": {"same_day": true, "patch_ids": ["0c00c75b81c9cf4e2c7dd727d7f47148"], "statement_hash": "6ef22cc70bed7a3bdbb01c79c02e183283e72e3ea1060f614fc65f0d30467462"}, "url": "/docs/compare/?release=15.19#15.19-88702f651f9db1ae", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}]}, {"id": "16.15-f0ba58d9c922a403-2", "cves": [], "html": "Fix cascading standby reconnect failure after archive fallback (Marco Nenciarini) §
\nA cascading standby could fail to reconnect to its upstream standby with “requested starting point ... is ahead of the WAL flush position” after falling back to archive recovery.
", "text": "Fix cascading standby reconnect failure after archive fallback (Marco Nenciarini) § A cascading standby could fail to reconnect to its upstream standby with “requested starting point ... is ahead of the WAL flush position” after falling back to archive recovery.", "title": "Fix cascading standby reconnect failure after archive fallback", "commits": ["5dbeb69bc"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "ad20ccfa745bcb89f7e4052627a53c01a4f244c549526f6ff700f20adba5e406", "section_path": ["Changes"], "commit_groups": [["2cf28d1b9", "331016322", "5dbeb69bc", "5fb3c6389", "8f64cc83f", "b614de487", "bef46aed3"]], "identity_text": "Fix cascading standby reconnect failure after archive fallback (Marco Nenciarini) A cascading standby could fail to reconnect to its upstream standby with requested starting point ... is ahead of the WAL flush position after falling back to archive recovery.", "commit_aliases": ["2cf28d1b9", "331016322", "5dbeb69bc", "5fb3c6389", "8f64cc83f", "b614de487", "bef46aed3"], "source_commits": ["5dbeb69bc"], "source_entry_id": "16.15/changes/069", "db_id": "bfa74492dd2c8ed5f4b0a4321cb63c85", "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "relations": [{"rule": 2, "type": "related", "target": "027ccc17f71deb2b38e14fc8cc82dccd", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "1b34d3e2b18d75096fd2914d3673446c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "1ba572e4a9f5584ecce320e293d4b258", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "70897dba323af27792543b2311799668", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "771fa954f9b22168a0764dc12074dadb", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "b17ef22f538327cabf0726e1b3f902cc", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "bf82a2510c4dfe4309435e9bce0ab3a4", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "related", "target": "bfa88fa3d381bbc9b7ee7a8614ea363c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}, {"rule": 2, "type": "equivalent", "target": "ea24770278021c00f25a8b13bceb2a2c", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "1ba572e4a9f5584ecce320e293d4b258", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=18.6#18.6-e75bd84b8c02b997", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "1b34d3e2b18d75096fd2914d3673446c", "kind": "related", "version": "18.6", "label": "18.6", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=18.6#18.6-251aba36d837c523", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "bf82a2510c4dfe4309435e9bce0ab3a4", "kind": "related", "version": "17.11", "label": "17.11", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=17.11#17.11-9aaf551ddc6d8e1b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b17ef22f538327cabf0726e1b3f902cc", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=17.11#17.11-8291f394c20dacdc", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "70897dba323af27792543b2311799668", "kind": "related", "version": "16.15", "label": "16.15", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=16.15#16.15-f0ba58d9c922a403-1", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES"}, {"db_id": "bfa88fa3d381bbc9b7ee7a8614ea363c", "kind": "related", "version": "15.19", "label": "15.19", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=15.19#15.19-4395db3387c7cd38-1", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "771fa954f9b22168a0764dc12074dadb", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=15.19#15.19-4395db3387c7cd38-2", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "ea24770278021c00f25a8b13bceb2a2c", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix cascading standby reconnect failure after archive fallback", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "statement_hash": "fb1d8ff1de50924ae1113199938a0ff6d45296b275bab29a749f5176ddbc64ad", "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=14.24#14.24-744489dc4872d6f1-2", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}, {"db_id": "027ccc17f71deb2b38e14fc8cc82dccd", "kind": "related", "version": "14.24", "label": "14.24", "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "evidence": {"same_day": true, "patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"], "ambiguous_patch_ids": ["8d6dc29f16ca43220ac734ee400f5ee9"]}, "url": "/docs/compare/?release=14.24#14.24-744489dc4872d6f1-1", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-2f83798db4bea0d0", "cves": [], "html": "Avoid race condition while dropping ephemeral replication slots (Zhijie Hou) §
\nThe slot-releasing code performed some additional updates to the replication slot's shared-memory entry after releasing the slot. This is unsafe since another session could immediately re-use the dropped slot's shared-memory entry. Skip those updates in the case of an ephemeral slot.
", "text": "Avoid race condition while dropping ephemeral replication slots (Zhijie Hou) § The slot-releasing code performed some additional updates to the replication slot's shared-memory entry after releasing the slot. This is unsafe since another session could immediately re-use the dropped slot's shared-memory entry. Skip those updates in the case of an ephemeral slot.", "title": "Avoid race condition while dropping ephemeral replication slots", "commits": ["51e79222c"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "82d9236a385e7b7a3ef8858f00cc576f4b57f7b2d7c6c032fd631a79e3a29771", "section_path": ["Changes"], "commit_groups": [["080d61f07", "51e79222c", "968c50845", "a4eb59d40", "f2081a780", "f833c9207"]], "identity_text": "Avoid race condition while dropping ephemeral replication slots (Zhijie Hou) The slot-releasing code performed some additional updates to the replication slot's shared-memory entry after releasing the slot. This is unsafe since another session could immediately re-use the dropped slot's shared-memory entry. Skip those updates in the case of an ephemeral slot.", "commit_aliases": ["080d61f07", "51e79222c", "968c50845", "a4eb59d40", "f2081a780", "f833c9207"], "source_commits": ["51e79222c"], "source_entry_id": "16.15/changes/070", "db_id": "f11ac7346f20210841ca22799f957bad", "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282", "relations": [{"rule": 2, "type": "equivalent", "target": "56d06487f4f5f34eaa3c2bcb9a9adcec", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}}, {"rule": 2, "type": "equivalent", "target": "68414efdd4fd28ffb448691fcc350390", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}}, {"rule": 2, "type": "equivalent", "target": "acb52269a9ab57fd523cb58a71e121ec", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}}, {"rule": 2, "type": "equivalent", "target": "e7a4717de56195de8e84ae36133e6f25", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "e7a4717de56195de8e84ae36133e6f25", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Avoid race condition while dropping ephemeral replication slots", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}, "url": "/docs/compare/?release=18.6#18.6-63934e389520e7b8", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "56d06487f4f5f34eaa3c2bcb9a9adcec", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Avoid race condition while dropping ephemeral replication slots", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}, "url": "/docs/compare/?release=17.11#17.11-1bc3f286c6ac2176", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "68414efdd4fd28ffb448691fcc350390", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Avoid race condition while dropping ephemeral replication slots", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}, "url": "/docs/compare/?release=15.19#15.19-1a1d1e09b86ffe89", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "acb52269a9ab57fd523cb58a71e121ec", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Avoid race condition while dropping ephemeral replication slots", "evidence": {"same_day": true, "patch_ids": ["a917b168697862cb05827b9e9d804879"], "statement_hash": "87055d6044521ae3f6b6a74d5c840e75e79be3ee687ddbb92cb366dcb1601282"}, "url": "/docs/compare/?release=14.24#14.24-b14b0a9051dbe228", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-d4efc1239b690c46", "cves": [], "html": "Fix stale progress reports during logical replication table synchronization (Shinya Kato) §
\nPreviously, the pg_stat_progress_copy view in the subscriber would continue to show the initial COPY operation as active even after the data copy had finished. The stale entry remained visible until synchronization caught up with the publisher.
Clear base backup progress on backup failure (Chao Li) § §
\nPreviously the pg_stat_progress_basebackup view would continue to show a stale progress entry after a failure, until the replication client disconnected. pg_basebackup normally disconnects immediately, but other clients might not.
Fix possible PANIC due to concurrent drop of pgstats entries when track_functions is enabled (Sami Imseih, Michael Paquier) § § §
Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry (Niall Newman) §
\nFailure to do this led to a null-pointer dereference the next time the local entry was used.
", "text": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry (Niall Newman) § Failure to do this led to a null-pointer dereference the next time the local entry was used.", "title": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry", "commits": ["636bcd6a5"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "178c7fb79c1e105a575ae052757ad3beabe918e946b63bafd2beaa85bf423f09", "section_path": ["Changes"], "commit_groups": [["10e20e59e", "2fd8d45ec", "4069df21b", "636bcd6a5", "89fc6a7c1", "fc9283b21"]], "identity_text": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry (Niall Newman) Failure to do this led to a null-pointer dereference the next time the local entry was used.", "commit_aliases": ["10e20e59e", "2fd8d45ec", "4069df21b", "636bcd6a5", "89fc6a7c1", "fc9283b21"], "source_commits": ["636bcd6a5"], "source_entry_id": "16.15/changes/074", "db_id": "1afc7388a3b74ce2c49cb081c26f6f41", "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e", "relations": [{"rule": 2, "type": "equivalent", "target": "65cb52740b6d4b79d67968be77af89f3", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}}, {"rule": 2, "type": "equivalent", "target": "69bb916ea3e2500fcf1ca6568c60960f", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}}, {"rule": 2, "type": "equivalent", "target": "b6f5540e817eacbe3e2ce2803c428998", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "69bb916ea3e2500fcf1ca6568c60960f", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}, "url": "/docs/compare/?release=18.6#18.6-8e68cf04f8d3d622", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "65cb52740b6d4b79d67968be77af89f3", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}, "url": "/docs/compare/?release=17.11#17.11-2a6d1da6de790ba0", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b6f5540e817eacbe3e2ce2803c428998", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Clean up broken local pgstats entry after failing to obtain space for the corresponding shared hashtable entry", "evidence": {"same_day": true, "patch_ids": ["073249ed6bcae15bb6d4063aa8558bab"], "statement_hash": "c60eb3598315d881be3eccb1a6430b61a597e0457159bd9304d33bd0c753b70e"}, "url": "/docs/compare/?release=15.19#15.19-038be6e3a9588b97", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}]}, {"id": "16.15-47a73b918734dfa4", "cves": [], "html": "In PL/Perl, avoid NULL pointer dereference crash when working with an invalid PostgreSQL::InServer::ARRAY object (Xing Guo) §
In PL/Python, properly check for errors when working with sequence and mapping objects (Richard Guo) §
\nPreviously, a broken object or an unhandled exception could result in a NULL pointer dereference crash.
", "text": "In PL/Python, properly check for errors when working with sequence and mapping objects (Richard Guo) § Previously, a broken object or an unhandled exception could result in a NULL pointer dereference crash.", "title": "In PL/Python, properly check for errors when working with sequence and mapping objects", "commits": ["e92f23bde"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "bb4ee7436ebed3ec6bfe5b03e9bedf1fa4c70ead34cd5d503f2cf7ad4432e363", "section_path": ["Changes"], "commit_groups": [["0b7719f74", "12bff46ff", "3dc59c173", "53482fcb9", "8612f0b7c", "e92f23bde"], ["309dc4526"]], "identity_text": "In PL/Python, properly check for errors when working with sequence and mapping objects (Richard Guo) Previously, a broken object or an unhandled exception could result in a NULL pointer dereference crash.", "commit_aliases": ["0b7719f74", "12bff46ff", "309dc4526", "3dc59c173", "53482fcb9", "8612f0b7c", "e92f23bde"], "source_commits": ["309dc4526", "e92f23bde"], "source_entry_id": "16.15/changes/076", "db_id": "c7d8f5074aecff2a6209080fb7907c5d", "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee", "relations": [{"rule": 2, "type": "equivalent", "target": "1bcdb1bad2833f07d4dbdd7f3fd25692", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}}, {"rule": 2, "type": "equivalent", "target": "5ee9ccfc012c4ede5db692562772a752", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}}, {"rule": 2, "type": "equivalent", "target": "7c536b903c2b846285e39de4051f4dda", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}}, {"rule": 2, "type": "equivalent", "target": "c6334af88dcf8bb00a0c24becb0804c2", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "c6334af88dcf8bb00a0c24becb0804c2", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "In PL/Python, properly check for errors when working with sequence and mapping objects", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}, "url": "/docs/compare/?release=18.6#18.6-728c054c41aaf74d", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "5ee9ccfc012c4ede5db692562772a752", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "In PL/Python, properly check for errors when working with sequence and mapping objects", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}, "url": "/docs/compare/?release=17.11#17.11-bf867cbb1ebe32c7", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "7c536b903c2b846285e39de4051f4dda", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "In PL/Python, properly check for errors when working with sequence and mapping objects", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}, "url": "/docs/compare/?release=15.19#15.19-b21d9c4c946d0a95", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "1bcdb1bad2833f07d4dbdd7f3fd25692", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "In PL/Python, properly check for errors when working with sequence and mapping objects", "evidence": {"same_day": true, "patch_ids": ["82aeda458da615307371e8d49ed0abdd", "a96949fcfb8c6bac8cc1705ad8aa548e"], "statement_hash": "33d469b3040d6c202f91bb0448f11a09e5ddae64c76bb00e48ee5634543c64ee"}, "url": "/docs/compare/?release=14.24#14.24-6e7031366ea0564c", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-1f1b12d570b54de1", "cves": [], "html": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData() (Jacob Champion) § § § §
This avoids edge cases where libpq or its calling application waits for more data to arrive on the socket, but actually all the data has already arrived.
", "text": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData() (Jacob Champion) § § § § This avoids edge cases where libpq or its calling application waits for more data to arrive on the socket, but actually all the data has already arrived.", "title": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData()", "commits": ["477bc27a5", "56988064b", "6243ea6c3", "d3f329656"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "e9fa19ebe787049851f164efc859daec9ed6664811035938fa2ac1627595e27c", "section_path": ["Changes"], "commit_groups": [["05908afcd", "177a2a2e3", "343594a26", "477bc27a5", "7f8745543", "bb0a54518", "d3888c90a"], ["0958c3ea4", "21a6c69ea", "27761c015", "536512f34", "6243ea6c3", "d293f0345", "f5f569713"], ["17accbe0f", "56988064b", "5ba13f8c0", "7532f2117", "87c3a79ea", "bab0a2db7", "d9eb70c9c"], ["1b018b5d1", "2167302b7", "4ecba7fa3", "c162810a5", "d3f329656", "eeb2940ae", "ffd080d94"]], "identity_text": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData() (Jacob Champion) This avoids edge cases where libpq or its calling application waits for more data to arrive on the socket, but actually all the data has already arrived.", "commit_aliases": ["05908afcd", "0958c3ea4", "177a2a2e3", "17accbe0f", "1b018b5d1", "2167302b7", "21a6c69ea", "27761c015", "343594a26", "477bc27a5", "4ecba7fa3", "536512f34", "56988064b", "5ba13f8c0", "6243ea6c3", "7532f2117", "7f8745543", "87c3a79ea", "bab0a2db7", "bb0a54518", "c162810a5", "d293f0345", "d3888c90a", "d3f329656", "d9eb70c9c", "eeb2940ae", "f5f569713", "ffd080d94"], "source_commits": ["477bc27a5", "56988064b", "6243ea6c3", "d3f329656"], "source_entry_id": "16.15/changes/077", "db_id": "c77eeb650517090fade53e3cf3d24d00", "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be", "relations": [{"rule": 2, "type": "equivalent", "target": "06f569df58220f97a2f065dcabd4567f", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}}, {"rule": 2, "type": "equivalent", "target": "9168ca39fb7c001030f5bfbd2405a57c", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}}, {"rule": 2, "type": "equivalent", "target": "964e3e4ad6311992f04c2399fc930719", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}}, {"rule": 2, "type": "equivalent", "target": "f60154c0b7e3d0ae2ae39034edcdc2c1", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "9168ca39fb7c001030f5bfbd2405a57c", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData()", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}, "url": "/docs/compare/?release=18.6#18.6-99e20888b0a13dd7", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "f60154c0b7e3d0ae2ae39034edcdc2c1", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData()", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}, "url": "/docs/compare/?release=17.11#17.11-ece298bedf647a6a", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "964e3e4ad6311992f04c2399fc930719", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData()", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}, "url": "/docs/compare/?release=15.19#15.19-8ddc290da7f872e4", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "06f569df58220f97a2f065dcabd4567f", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "In libpq, always drain all pending bytes from the SSL or GSS decryption buffer during pqReadData()", "evidence": {"same_day": true, "patch_ids": ["0b824057774a76b143d700730eb3e762", "cc43f5c943c90e1a9e72f73b95bcd867", "dd46de527b9a0334591039f236b5d00d", "fdc82cd35935c0be303512dba39e65fe"], "statement_hash": "8034e64e929755fda7f40131432f08c549be661e2525d6f7be6b5192313374be"}, "url": "/docs/compare/?release=14.24#14.24-4595e71bf9e7dee5", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-d31bbe08eb795d29", "cves": [], "html": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes (Ning Sun) §
\nPreviously, this message type was not among those that libpq's validity heuristics believed could be long. The limit resulted in failure for prepared queries having more than 7498 parameters, which is unlikely but supported.
", "text": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes (Ning Sun) § Previously, this message type was not among those that libpq's validity heuristics believed could be long. The limit resulted in failure for prepared queries having more than 7498 parameters, which is unlikely but supported.", "title": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes", "commits": ["8d516d2b9"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "635395e2ea3009be86b05521b004e6e18f96349d4006d454dce03da7f8141dae", "section_path": ["Changes"], "commit_groups": [["0f63b74a4", "1b79c8d1a", "8d516d2b9", "b1ab4bc52", "e0511883c", "e4183c667"]], "identity_text": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes (Ning Sun) Previously, this message type was not among those that libpq's validity heuristics believed could be long. The limit resulted in failure for prepared queries having more than 7498 parameters, which is unlikely but supported.", "commit_aliases": ["0f63b74a4", "1b79c8d1a", "8d516d2b9", "b1ab4bc52", "e0511883c", "e4183c667"], "source_commits": ["8d516d2b9"], "source_entry_id": "16.15/changes/078", "db_id": "7b36888afdccf5778f4b3d9b3f4d4b19", "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548", "relations": [{"rule": 2, "type": "equivalent", "target": "5ebbe0622604b80c5219c1c82f7d9aca", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}}, {"rule": 2, "type": "equivalent", "target": "96f87cdaa195bfc8af2e374fe5cd785d", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}}, {"rule": 2, "type": "equivalent", "target": "97c44cf1d7b9b31d86691416921a75e4", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}}, {"rule": 2, "type": "equivalent", "target": "c1e7d9148740f6776370a4a75311e436", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "c1e7d9148740f6776370a4a75311e436", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}, "url": "/docs/compare/?release=18.6#18.6-524638e22a952ee0", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "97c44cf1d7b9b31d86691416921a75e4", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}, "url": "/docs/compare/?release=17.11#17.11-a3c4e49ff3e57eff", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "5ebbe0622604b80c5219c1c82f7d9aca", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}, "url": "/docs/compare/?release=15.19#15.19-30059fe54da9df27", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "96f87cdaa195bfc8af2e374fe5cd785d", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Allow libpq to accept ParameterDescription messages exceeding 30000 bytes", "evidence": {"same_day": true, "patch_ids": ["b6b26c4c8b27c2138732ea0f070c591b"], "statement_hash": "2bf8dba03893ccac611f0c0a15dfeaa8cb7ed7f18e2fbb58d26e630ffd77a548"}, "url": "/docs/compare/?release=14.24#14.24-95bdb4ccbaf1b4f7", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-0bc3bd0290f2c7ce", "cves": [], "html": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements (Masashi Kamura) §
Previously the grammar allowed this syntax, but broken C code was generated. Adjust the grammar and the documentation to allow only one header item.
", "text": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements (Masashi Kamura) § Previously the grammar allowed this syntax, but broken C code was generated. Adjust the grammar and the documentation to allow only one header item.", "title": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements", "commits": ["4d4b73cfd"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "d68b2fadf074e14e778c971bf2528097dbf3e927d8807e8a2af86a9d26693a8f", "section_path": ["Changes"], "commit_groups": [["081434b0f", "4484165b0", "4d4b73cfd", "9e8fd9f7a", "bfeddcf09", "fe8c0a762"]], "identity_text": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements (Masashi Kamura) Previously the grammar allowed this syntax, but broken C code was generated. Adjust the grammar and the documentation to allow only one header item.", "commit_aliases": ["081434b0f", "4484165b0", "4d4b73cfd", "9e8fd9f7a", "bfeddcf09", "fe8c0a762"], "source_commits": ["4d4b73cfd"], "source_entry_id": "16.15/changes/079", "db_id": "f619d880f7a5f55846623a2af12abad1", "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb", "relations": [{"rule": 2, "type": "equivalent", "target": "2d1814d3627bd7de23f302bac9690b77", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}}, {"rule": 2, "type": "equivalent", "target": "aa20c63216e98c98f035fa86491b5b30", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}}, {"rule": 2, "type": "equivalent", "target": "d5ef1996d66a6c71b921d8881446c413", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}}, {"rule": 2, "type": "equivalent", "target": "e7657a963bd66274d46d2b5a9e11a18a", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "aa20c63216e98c98f035fa86491b5b30", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}, "url": "/docs/compare/?release=18.6#18.6-f7ec4316771ce1eb", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "2d1814d3627bd7de23f302bac9690b77", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}, "url": "/docs/compare/?release=17.11#17.11-4edba097ad3499b7", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "e7657a963bd66274d46d2b5a9e11a18a", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}, "url": "/docs/compare/?release=15.19#15.19-42a85b1c95cc8d74", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "d5ef1996d66a6c71b921d8881446c413", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Reject multiple descriptor header items in ecpg's GET/SET DESCRIPTOR statements", "evidence": {"same_day": true, "patch_ids": ["4f4dddcf40354c994e2b6668a43af20d"], "statement_hash": "e3bda298ded00b77261ba1c76b32c15895630f65da4a428ed88a0e425a4414cb"}, "url": "/docs/compare/?release=14.24#14.24-fb2fbbf70338d662", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-4ef439582c28e17a", "cves": [], "html": "Make line widths match in psql's expanded aligned output format (Pavel Stehule) §
\nWhen the table's data rows are narrower than the record header lines, widen the data rows to match the headers, avoiding unsightly output.
", "text": "Make line widths match in psql's expanded aligned output format (Pavel Stehule) § When the table's data rows are narrower than the record header lines, widen the data rows to match the headers, avoiding unsightly output.", "title": "Make line widths match in psql's expanded aligned output format", "commits": ["1edbe6695"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "8f5032d513bafdd3e8ef25827b75449d393726b8245c88e3f098024d95921d61", "section_path": ["Changes"], "commit_groups": [["022ba5c61", "07a6c262b", "1edbe6695", "3d0d6741d", "a4ca91ea1", "efd885d05"]], "identity_text": "Make line widths match in psql's expanded aligned output format (Pavel Stehule) When the table's data rows are narrower than the record header lines, widen the data rows to match the headers, avoiding unsightly output.", "commit_aliases": ["022ba5c61", "07a6c262b", "1edbe6695", "3d0d6741d", "a4ca91ea1", "efd885d05"], "source_commits": ["1edbe6695"], "source_entry_id": "16.15/changes/080", "db_id": "73be9a684058fbdc9b8dd586127fd52a", "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6", "relations": [{"rule": 2, "type": "equivalent", "target": "58d0bf8b8ffb214d0f6ab86e01e2ee4d", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}}, {"rule": 2, "type": "equivalent", "target": "6a176afe78ae457a5f2e20281e68c1c8", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}}, {"rule": 2, "type": "equivalent", "target": "6d353eb0c8713cda0665ed6128c86dc7", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}}, {"rule": 2, "type": "equivalent", "target": "8c98433b203fc9f697cb6dfef2f22a70", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "8c98433b203fc9f697cb6dfef2f22a70", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Make line widths match in psql's expanded aligned output format", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}, "url": "/docs/compare/?release=18.6#18.6-e95d42c0b0a749e2", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "6a176afe78ae457a5f2e20281e68c1c8", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Make line widths match in psql's expanded aligned output format", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}, "url": "/docs/compare/?release=17.11#17.11-410e9178511c3bd6", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "58d0bf8b8ffb214d0f6ab86e01e2ee4d", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Make line widths match in psql's expanded aligned output format", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}, "url": "/docs/compare/?release=15.19#15.19-e6841047ca307274", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "6d353eb0c8713cda0665ed6128c86dc7", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Make line widths match in psql's expanded aligned output format", "evidence": {"same_day": true, "patch_ids": ["e1ed38dd6fb22dc6b3c388c344a54963"], "statement_hash": "bfb36185dbcab5e46aea9291f19969eb343ad3998992659ae2d4c88cea80e5d6"}, "url": "/docs/compare/?release=14.24#14.24-44ddceba221fbb20", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-7be17665f3a07ebd", "cves": [], "html": "Fix psql's privilege check for showing database size in \\l+ (Christoph Berg) §
The underlying server function permits users who have pg_read_all_stats privileges to see the sizes of all databases, even if they lack CONNECT privilege. But psql was unaware of that provision and would not call the function unless the user has CONNECT privilege.
Fix psql's tab completion for \\df to consider procedures too (Erik Wienhold) §
Fix thread-safety bug in pgbench (Fujii Masao) §
\nWhen pgbench runs with multiple threads and the --verbose-errors option, different threads could attempt to use the same buffer to construct error messages, leading to corrupted log output.
Use the source cluster's group-read file permissions for pg_recvlogical output files (Fujii Masao) §
\npg_recvlogical was documented to behave this way, but it never actually enabled group-read.
", "text": "Use the source cluster's group-read file permissions for pg_recvlogical output files (Fujii Masao) § pg_recvlogical was documented to behave this way, but it never actually enabled group-read.", "title": "Use the source cluster's group-read file permissions for pg_recvlogical output files", "commits": ["9590dcfca"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "da5a7bab7f64bdd46a4866b23b6846bf519de03a92bb61ce20363209a06fa913", "section_path": ["Changes"], "commit_groups": [["263d1e6df", "5552a15a3", "89b4b3ae3", "9590dcfca", "ba9833a75", "ddd12d1a5"]], "identity_text": "Use the source cluster's group-read file permissions for pg_recvlogical output files (Fujii Masao) pg_recvlogical was documented to behave this way, but it never actually enabled group-read.", "commit_aliases": ["263d1e6df", "5552a15a3", "89b4b3ae3", "9590dcfca", "ba9833a75", "ddd12d1a5"], "source_commits": ["9590dcfca"], "source_entry_id": "16.15/changes/084", "db_id": "f4924985d224acc909a53983f158ebbe", "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e", "relations": [{"rule": 2, "type": "equivalent", "target": "46627f579bf31b5d6613ea2ead9a438c", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}}, {"rule": 2, "type": "equivalent", "target": "5e9c0809074f8046eb23cf8c625f723d", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}}, {"rule": 2, "type": "equivalent", "target": "739e2a6e3be37fb134a81099033e7b88", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}}, {"rule": 2, "type": "equivalent", "target": "7c4fc2d9507cff650a6e11a00319e316", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "739e2a6e3be37fb134a81099033e7b88", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Use the source cluster's group-read file permissions for pg_recvlogical output files", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}, "url": "/docs/compare/?release=18.6#18.6-ccc1d394ba38511a", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "7c4fc2d9507cff650a6e11a00319e316", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Use the source cluster's group-read file permissions for pg_recvlogical output files", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}, "url": "/docs/compare/?release=17.11#17.11-7a66a4f0ad5abf3d", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "46627f579bf31b5d6613ea2ead9a438c", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Use the source cluster's group-read file permissions for pg_recvlogical output files", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}, "url": "/docs/compare/?release=15.19#15.19-eb042822e75a511b", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "5e9c0809074f8046eb23cf8c625f723d", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Use the source cluster's group-read file permissions for pg_recvlogical output files", "evidence": {"same_day": true, "patch_ids": ["afbffd5094352bc11bf18ec699c42866"], "statement_hash": "76c08921b60501e09bdf60cd197949c5372599c542dc2702bad076644bfb808e"}, "url": "/docs/compare/?release=14.24#14.24-af180ca6c48802b4", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-22551bc799d71de7", "cves": [], "html": "In contrib/amcheck, handle short-header varlena datums correctly (Andrey Borodin) §
This error could result in doing excess work while verifying a btree index, but seems not to have had any worse consequences.
", "text": "In contrib/amcheck, handle short-header varlena datums correctly (Andrey Borodin) § This error could result in doing excess work while verifying a btree index, but seems not to have had any worse consequences.", "title": "In contrib/amcheck, handle short-header varlena datums correctly", "commits": ["c89a1ca01"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "0f0699f0820c30e4718e72a1a4fa85da60e46d9cb2267973331b67d9fb4aad3b", "section_path": ["Changes"], "commit_groups": [["4284476c0", "897e79486", "8abb8a155", "af09b18cb", "c89a1ca01", "da1eff08a"]], "identity_text": "In contrib/amcheck, handle short-header varlena datums correctly (Andrey Borodin) This error could result in doing excess work while verifying a btree index, but seems not to have had any worse consequences.", "commit_aliases": ["4284476c0", "897e79486", "8abb8a155", "af09b18cb", "c89a1ca01", "da1eff08a"], "source_commits": ["c89a1ca01"], "source_entry_id": "16.15/changes/085", "db_id": "e3d3da7d18247e58916c107812921cf0", "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d", "relations": [{"rule": 2, "type": "equivalent", "target": "2d507c3ecfdc88b0a54eabbb1a06a7e0", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}}, {"rule": 2, "type": "equivalent", "target": "3b8c851869278523310ddb5e0cf66c28", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}}, {"rule": 2, "type": "equivalent", "target": "45cd63fac27296a03920e2ac709b0ed6", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}}, {"rule": 2, "type": "equivalent", "target": "cdde56de8d6ffe6162fb47b834f39528", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "2d507c3ecfdc88b0a54eabbb1a06a7e0", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "In contrib/amcheck, handle short-header varlena datums correctly", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}, "url": "/docs/compare/?release=18.6#18.6-83d0b073d364f75c", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "3b8c851869278523310ddb5e0cf66c28", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "In contrib/amcheck, handle short-header varlena datums correctly", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}, "url": "/docs/compare/?release=17.11#17.11-43173bad4eaa1b27", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "45cd63fac27296a03920e2ac709b0ed6", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "In contrib/amcheck, handle short-header varlena datums correctly", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}, "url": "/docs/compare/?release=15.19#15.19-2872239e215fe909", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "cdde56de8d6ffe6162fb47b834f39528", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "In contrib/amcheck, handle short-header varlena datums correctly", "evidence": {"same_day": true, "patch_ids": ["d7fc6f8977003129b1104cd80d7d07dc"], "statement_hash": "e472f473c1b1497e339e1735040e13130df76e2534eb81a81dc2b51327126c5d"}, "url": "/docs/compare/?release=14.24#14.24-de8368e77c874cdf", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-b6551e55dcd75e6b", "cves": [], "html": "In contrib/btree_gist, fix NaN handling in the float4 and float8 opclasses (Bill Kim, Tom Lane) §
Comparisons, as well as the GiST penalty and distance functions, did not account for NaN and would give the wrong answer when handed one. It is recommended to reindex btree_gist indexes on float columns after installing this update, if there is any possibility that there are NaN entries in those columns.
In contrib/btree_gist, fix searches using a not-equal operator (Ayush Tiwari) §
For variable-length data types, the code for scanning non-leaf index pages applied the wrong comparison function, leading to wrong results and potentially crashes.
", "text": "In contrib/btree_gist, fix searches using a not-equal operator (Ayush Tiwari) § For variable-length data types, the code for scanning non-leaf index pages applied the wrong comparison function, leading to wrong results and potentially crashes.", "title": "In contrib/btree_gist, fix searches using a not-equal operator", "commits": ["0663382c9"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "321ad60540053a4bee7f553671e0ead74110229ae84e846a3790027eb8ca9565", "section_path": ["Changes"], "commit_groups": [["0663382c9", "12c519207", "286f9a3ce", "86992769e", "8f2a1b3d3", "eef644e57", "fc6649abe"]], "identity_text": "In contrib/btree_gist, fix searches using a not-equal operator (Ayush Tiwari) For variable-length data types, the code for scanning non-leaf index pages applied the wrong comparison function, leading to wrong results and potentially crashes.", "commit_aliases": ["0663382c9", "12c519207", "286f9a3ce", "86992769e", "8f2a1b3d3", "eef644e57", "fc6649abe"], "source_commits": ["0663382c9"], "source_entry_id": "16.15/changes/087", "db_id": "72b13e01606442471a1d73d64267d5db", "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a", "relations": [{"rule": 2, "type": "equivalent", "target": "635407feb25f134fd4b583a750d226fd", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}}, {"rule": 2, "type": "equivalent", "target": "6a17d9b57b1644e479653b086d9a3d5b", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}}, {"rule": 2, "type": "equivalent", "target": "b8f3ffff9bd8249a29d2857d5a2613d1", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}}, {"rule": 2, "type": "equivalent", "target": "c540681583edc5cf717591e5bf65da83", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "6a17d9b57b1644e479653b086d9a3d5b", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "In contrib/btree_gist, fix searches using a not-equal operator", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}, "url": "/docs/compare/?release=18.6#18.6-ba3d35f49ebe5363", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "c540681583edc5cf717591e5bf65da83", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "In contrib/btree_gist, fix searches using a not-equal operator", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}, "url": "/docs/compare/?release=17.11#17.11-bb79dbfaaf4bd7a5", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "b8f3ffff9bd8249a29d2857d5a2613d1", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "In contrib/btree_gist, fix searches using a not-equal operator", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}, "url": "/docs/compare/?release=15.19#15.19-400657eaecfa8eb8", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "635407feb25f134fd4b583a750d226fd", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "In contrib/btree_gist, fix searches using a not-equal operator", "evidence": {"same_day": true, "patch_ids": ["515eccc8717dfd3bf829ad309ee292d4"], "statement_hash": "2be1ae243cd8ebc1e8e722c0adfd189a77f8b7ec2ce84c5f76afc7ac0990135a"}, "url": "/docs/compare/?release=14.24#14.24-294f04d16131e8d5", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-fa0a92fe6f6d8b62", "cves": [], "html": "Fix unguarded recursion and loops in contrib/hstore_plperl, contrib/jsonb_plperl, and contrib/jsonb_plpython (Aleksander Alekseev) § §
Prevent stack overflow when dealing with deeply nested jsonb values, and allow interruption of the infinite loop caused when attempting to dereference circular chains of Perl object references.
Fix missed release of statistics catcache entry in contrib/intarray (Man Zeng) §
This oversight led to warnings like “resource was not closed: cache pg_statistic”.
", "text": "Fix missed release of statistics catcache entry in contrib/intarray (Man Zeng) § This oversight led to warnings like “resource was not closed: cache pg_statistic”.", "title": "Fix missed release of statistics catcache entry in contrib/intarray", "commits": ["273be484a"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "b1f19003e8b64b7c519f87efe7454e7a5d986fbe4b6ee95c51e612e1656c0156", "section_path": ["Changes"], "commit_groups": [["273be484a", "524cc0f63", "702a6d5f6", "94b57ab54", "a96b051a9", "e7544c518"]], "identity_text": "Fix missed release of statistics catcache entry in contrib/intarray (Man Zeng) This oversight led to warnings like resource was not closed: cache pg_statistic.", "commit_aliases": ["273be484a", "524cc0f63", "702a6d5f6", "94b57ab54", "a96b051a9", "e7544c518"], "source_commits": ["273be484a"], "source_entry_id": "16.15/changes/089", "db_id": "a4dfb26ea114f9668f1e953f8895f530", "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3", "relations": [{"rule": 2, "type": "equivalent", "target": "29b63a7300df9efc4d5ac1e96dc34cb7", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}}, {"rule": 2, "type": "equivalent", "target": "2c29490e6377bc8f4bb49b5d5ca76323", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}}, {"rule": 2, "type": "equivalent", "target": "441b437853466f13724bc66579a3d9c5", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}}, {"rule": 2, "type": "equivalent", "target": "531f88cd6dd693227e011632166ae87b", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "531f88cd6dd693227e011632166ae87b", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix missed release of statistics catcache entry in contrib/intarray", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}, "url": "/docs/compare/?release=18.6#18.6-69c78fae0c5ccd69", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "29b63a7300df9efc4d5ac1e96dc34cb7", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix missed release of statistics catcache entry in contrib/intarray", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}, "url": "/docs/compare/?release=17.11#17.11-c1417114cda9dd52", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "2c29490e6377bc8f4bb49b5d5ca76323", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix missed release of statistics catcache entry in contrib/intarray", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}, "url": "/docs/compare/?release=15.19#15.19-ccb32043172a0059", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "441b437853466f13724bc66579a3d9c5", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix missed release of statistics catcache entry in contrib/intarray", "evidence": {"same_day": true, "patch_ids": ["ed91737595bc2b3f155e28dcd1a2eea2"], "statement_hash": "f94e4dacb87f6c952276d56347322f0e3b34e2c00c7f4e555ef6c2806632dec3"}, "url": "/docs/compare/?release=14.24#14.24-88b2eacb476e6d44", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-b86543a0103877e6", "cves": [], "html": "In contrib/ltree, fix integer overflow in comparisons (Ayush Tiwari) §
ltree values containing more than about 14,653 labels resulted in wrong comparison answers due to overflow. If a btree index contains such values, it is probably corrupt and should be reindexed after installing this update.
Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions (Michael Paquier) §
Attempting to change a TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the allocated array, potentially crashing the server.
", "text": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions (Michael Paquier) § Attempting to change a TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the allocated array, potentially crashing the server.", "title": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions", "commits": ["daf8bc7d4"], "section": "Changes", "category": "bugfix", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "f6711320dba4cd045604e202cd18186d91b36fecf47f5ed7bdbe85c4d1698471", "section_path": ["Changes"], "commit_groups": [["0bcf19c9e", "193a4ded9", "1eda3eb07", "2b09f8a91", "51f63ba2b", "daf8bc7d4"]], "identity_text": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions (Michael Paquier) Attempting to change a TID whose offset number equals MaxHeapTuplesPerPage wrote one byte past the end of the allocated array, potentially crashing the server.", "commit_aliases": ["0bcf19c9e", "193a4ded9", "1eda3eb07", "2b09f8a91", "51f63ba2b", "daf8bc7d4"], "source_commits": ["daf8bc7d4"], "source_entry_id": "16.15/changes/091", "db_id": "dd33ec95e198e9db76b741cb251151f9", "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae", "relations": [{"rule": 2, "type": "equivalent", "target": "34c6abdf99153564a44d057cfe4b6dac", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}}, {"rule": 2, "type": "equivalent", "target": "68b2c21176cad03670e2c5de5fd39431", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}}, {"rule": 2, "type": "equivalent", "target": "bfda1df269b11b96600aa8d604c7a26a", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}}, {"rule": 2, "type": "equivalent", "target": "f14b53949f2fa5150ed94f6fdbc3af9e", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}}], "version": "16.15", "category_label": "Bug fixes", "also_in": [], "variants": [], "related_changes": [{"db_id": "34c6abdf99153564a44d057cfe4b6dac", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}, "url": "/docs/compare/?release=18.6#18.6-2f1813bf59f642ea", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "bfda1df269b11b96600aa8d604c7a26a", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}, "url": "/docs/compare/?release=17.11#17.11-e5e220ac4d63838b", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "68b2c21176cad03670e2c5de5fd39431", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}, "url": "/docs/compare/?release=15.19#15.19-d4a24c821b2c9a40", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "f14b53949f2fa5150ed94f6fdbc3af9e", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Fix array overrun in contrib/pg_surgery's heap_force_kill and heap_force_freeze functions", "evidence": {"same_day": true, "patch_ids": ["eb798217c4bf865d1840668bc6612f6d"], "statement_hash": "0c283cf21db62b067b9adc880d22c26404e9404758237c1adc833a4aa35981ae"}, "url": "/docs/compare/?release=14.24#14.24-5408ce883ba1bd1f", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-063e603810851d1d", "cves": [], "html": "In contrib/pg_surgery, avoid infinite loop with TID arrays having more than 64K elements (Andrey Rachitskiy) §
Avoid NULL-pointer dereference in contrib/refint's check_foreign_key() (Ayush Tiwari) §
In the on-update-cascade case, a null value of a referenced column led to a crash. This is an oversight in the fix for CVE-2026-6637, but the code that was there before that wasn't really right either.
", "text": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key() (Ayush Tiwari) § In the on-update-cascade case, a null value of a referenced column led to a crash. This is an oversight in the fix for CVE-2026-6637, but the code that was there before that wasn't really right either.", "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "commits": ["eb93f10e2"], "section": "Changes", "category": "security", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "57d9114e918c9fc6db14be3a20b87f4273cf1ead1ca1c0e574df24b00c34f5bb", "section_path": ["Changes"], "commit_groups": [["1de0a711d", "611756948", "6b4de201e", "77b2d18e9", "eb93f10e2", "ed0c4d5af"]], "identity_text": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key() (Ayush Tiwari) In the on-update-cascade case, a null value of a referenced column led to a crash. This is an oversight in the fix for CVE-2026-6637, but the code that was there before that wasn't really right either.", "commit_aliases": ["1de0a711d", "611756948", "6b4de201e", "77b2d18e9", "eb93f10e2", "ed0c4d5af"], "source_commits": ["eb93f10e2"], "source_entry_id": "16.15/changes/093", "db_id": "a4fcc13dcc4b7cf6a5470b40915f7de5", "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374", "relations": [{"rule": 2, "type": "equivalent", "target": "1404c503877f8a1f5c524fd84656cf87", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}}, {"rule": 2, "type": "equivalent", "target": "220e195253d94eac399969a628bda519", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}}, {"rule": 2, "type": "equivalent", "target": "4a53f44037d5d1ea5b714eb8d91567ee", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}}, {"rule": 2, "type": "equivalent", "target": "98b367e0c42416fd78e2312f81ec66e2", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}}], "version": "16.15", "category_label": "Security", "also_in": [], "variants": [], "related_changes": [{"db_id": "1404c503877f8a1f5c524fd84656cf87", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}, "url": "/docs/compare/?release=18.6#18.6-8573bd52d03d8b3e", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "4a53f44037d5d1ea5b714eb8d91567ee", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}, "url": "/docs/compare/?release=17.11#17.11-3c3f973709d9fe9a", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "220e195253d94eac399969a628bda519", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}, "url": "/docs/compare/?release=15.19#15.19-e808c12e0db01138", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "98b367e0c42416fd78e2312f81ec66e2", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "evidence": {"same_day": true, "patch_ids": ["47510ee01f1ec9c76e280af528461da2"], "statement_hash": "95ffa03f4949f1fbe65efb454898eb0f8b9358951a8110fcc4b0547102b37374"}, "url": "/docs/compare/?release=14.24#14.24-1db62b2c5a9b5839", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-2bba48da7c744466", "cves": [], "html": "Fix contrib/seg to print segments with ~ certainty indicators correctly (Ewan Young) §
Due to a typo, seg_out() did not print a ~ certainty indicator attached to a segment's upper boundary. Worse, if the lower boundary had ~ while the upper boundary had no indicator, the upper boundary was not printed at all, incorrectly converting the value into an open interval.
Fix crash with namespace nodes in contrib/xml2's xpath_nodeset() function (Andrey Chernyy, Michael Paquier) §
Support building PostgreSQL with Visual Studio 2026 (Andrew Dunstan) §
", "text": "Support building PostgreSQL with Visual Studio 2026 (Andrew Dunstan) §", "title": "Support building PostgreSQL with Visual Studio 2026", "commits": ["bc5a873a8"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "299ff3eda9fd621dc200dfd3cd71d271e3d89be770b911762eda30066a1a197f", "section_path": ["Changes"], "commit_groups": [["bc5a873a8", "eba7f1dc0", "f1c579fc4"]], "identity_text": "Support building PostgreSQL with Visual Studio 2026 (Andrew Dunstan)", "commit_aliases": ["bc5a873a8", "eba7f1dc0", "f1c579fc4"], "source_commits": ["bc5a873a8"], "source_entry_id": "16.15/changes/096", "db_id": "5655e5022f22026045632bccc741d725", "patch_ids": ["350b84561314ae3956b61523a936dc23"], "statement_hash": "a91781743ce2b194ac51f5c136b372071abdd36a850a23eda451bbb6bf8387e7", "relations": [{"rule": 2, "type": "equivalent", "target": "41e5c60ae40172d0cfdddcb33d14fb8a", "evidence": {"same_day": true, "patch_ids": ["350b84561314ae3956b61523a936dc23"], "statement_hash": "a91781743ce2b194ac51f5c136b372071abdd36a850a23eda451bbb6bf8387e7"}}, {"rule": 2, "type": "equivalent", "target": "daffe87e848e7599b381d9a4f90ea3c0", "evidence": {"same_day": true, "patch_ids": ["350b84561314ae3956b61523a936dc23"], "statement_hash": "a91781743ce2b194ac51f5c136b372071abdd36a850a23eda451bbb6bf8387e7"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "41e5c60ae40172d0cfdddcb33d14fb8a", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Support building PostgreSQL with Visual Studio 2026", "evidence": {"same_day": true, "patch_ids": ["350b84561314ae3956b61523a936dc23"], "statement_hash": "a91781743ce2b194ac51f5c136b372071abdd36a850a23eda451bbb6bf8387e7"}, "url": "/docs/compare/?release=15.19#15.19-5afbf0440f9a6852", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "daffe87e848e7599b381d9a4f90ea3c0", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Support building PostgreSQL with Visual Studio 2026", "evidence": {"same_day": true, "patch_ids": ["350b84561314ae3956b61523a936dc23"], "statement_hash": "a91781743ce2b194ac51f5c136b372071abdd36a850a23eda451bbb6bf8387e7"}, "url": "/docs/compare/?release=14.24#14.24-72a0fb4cd2ab3ca1", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-1b5271a8f18e77e3", "cves": [], "html": "Support building PostgreSQL with OpenSSL 4 (Daniel Gustafsson) §
", "text": "Support building PostgreSQL with OpenSSL 4 (Daniel Gustafsson) §", "title": "Support building PostgreSQL with OpenSSL 4", "commits": ["fb8befa7b"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "8cf7f955d7e229db4c7a69b59815c6ac087b50e17ba04710ff6d7fe101b8f429", "section_path": ["Changes"], "commit_groups": [["086652c02", "27cf3b5af", "89d243d52", "8bcabfcce", "c7f70fa1b", "fb8befa7b"]], "identity_text": "Support building PostgreSQL with OpenSSL 4 (Daniel Gustafsson)", "commit_aliases": ["086652c02", "27cf3b5af", "89d243d52", "8bcabfcce", "c7f70fa1b", "fb8befa7b"], "source_commits": ["fb8befa7b"], "source_entry_id": "16.15/changes/097", "db_id": "5205dd7058f572a69fe179e448446706", "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729", "relations": [{"rule": 2, "type": "equivalent", "target": "10ee20e58ffd04daecf6e5f030162c87", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}}, {"rule": 2, "type": "equivalent", "target": "3814ca74f63c29149528542a43ad21c5", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}}, {"rule": 2, "type": "equivalent", "target": "5a9bafbcf49a80b12f21e542e3bae026", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}}, {"rule": 2, "type": "equivalent", "target": "c3287f3d7329f9fd4fb1dead8c819569", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "c3287f3d7329f9fd4fb1dead8c819569", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Support building PostgreSQL with OpenSSL 4", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}, "url": "/docs/compare/?release=18.6#18.6-48c6d3c86320b73f", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "3814ca74f63c29149528542a43ad21c5", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Support building PostgreSQL with OpenSSL 4", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}, "url": "/docs/compare/?release=17.11#17.11-f6b857a06e35de57", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "5a9bafbcf49a80b12f21e542e3bae026", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Support building PostgreSQL with OpenSSL 4", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}, "url": "/docs/compare/?release=15.19#15.19-50448fe82729f9d3", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "10ee20e58ffd04daecf6e5f030162c87", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Support building PostgreSQL with OpenSSL 4", "evidence": {"same_day": true, "patch_ids": ["17c49f696c0a31900846c5a8c98eebd4"], "statement_hash": "c7b934d532c3b5d79d29d9130c3ab4f97028c3c1aa16422bb9101d84ad828729"}, "url": "/docs/compare/?release=14.24#14.24-192a685e063a0595", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}, {"id": "16.15-d220a135cd5ed833", "cves": [], "html": "Update time zone data files to tzdata release 2026c (Tom Lane) §
\nAlberta (America/Edmonton) will be on year-round UTC-06 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be CST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used.
Morocco (Africa/Casablanca) will move to permanent UTC+00, without daylight saving time transitions, on 2026-09-20.
", "text": "Update time zone data files to tzdata release 2026c (Tom Lane) § Alberta (America/Edmonton) will be on year-round UTC-06 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be CST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used. Morocco (Africa/Casablanca) will move to permanent UTC+00, without daylight saving time transitions, on 2026-09-20.", "title": "Update time zone data files to tzdata release 2026c", "commits": ["796c275a0"], "section": "Changes", "category": "improvement", "source_url": "/docs/release/16.15/#RELEASE-16-15-CHANGES", "source_hash": "6f2118fe5fbe17dc97b6f9b9a3ae0922a5b6645801521cfc96a9446c6b622356", "section_path": ["Changes"], "commit_groups": [["3c16aa293", "5f67124fa", "669438aed", "6ca405938", "796c275a0", "812cc1a73", "af7be5672"]], "identity_text": "Update time zone data files to tzdata release 2026c (Tom Lane) Alberta (America/Edmonton) will be on year-round UTC-06 (effectively, permanent DST) beginning in November 2026. This release assumes that their TZ abbreviation will be CST from that time forward. That seems likely to change, but it's unclear what new abbreviation will be used. Morocco (Africa/Casablanca) will move to permanent UTC+00, without daylight saving time transitions, on 2026-09-20.", "commit_aliases": ["3c16aa293", "5f67124fa", "669438aed", "6ca405938", "796c275a0", "812cc1a73", "af7be5672"], "source_commits": ["796c275a0"], "source_entry_id": "16.15/changes/098", "db_id": "ae8d1b295c148a9982765709cf1583a9", "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7", "relations": [{"rule": 2, "type": "equivalent", "target": "163da88262eec7e167bed3e56a48dcc3", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}}, {"rule": 2, "type": "equivalent", "target": "5d6e219dd117842cc9b25b660af47952", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}}, {"rule": 2, "type": "equivalent", "target": "6c00ccb389c691ec829366a2dd6d8fd7", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}}, {"rule": 2, "type": "equivalent", "target": "afb53916a223205ed20435542f0bacc1", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}}], "version": "16.15", "category_label": "Improvements", "also_in": [], "variants": [], "related_changes": [{"db_id": "5d6e219dd117842cc9b25b660af47952", "kind": "equivalent", "version": "18.6", "label": "18.6", "title": "Update time zone data files to tzdata release 2026c", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}, "url": "/docs/compare/?release=18.6#18.6-d9abf44820fbecc5", "source_url": "/docs/release/18.6/#RELEASE-18-6-CHANGES"}, {"db_id": "6c00ccb389c691ec829366a2dd6d8fd7", "kind": "equivalent", "version": "17.11", "label": "17.11", "title": "Update time zone data files to tzdata release 2026c", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}, "url": "/docs/compare/?release=17.11#17.11-8abc326e9afc0d23", "source_url": "/docs/release/17.11/#RELEASE-17-11-CHANGES"}, {"db_id": "163da88262eec7e167bed3e56a48dcc3", "kind": "equivalent", "version": "15.19", "label": "15.19", "title": "Update time zone data files to tzdata release 2026c", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}, "url": "/docs/compare/?release=15.19#15.19-661a397eafb52141", "source_url": "/docs/release/15.19/#id-1.11.6.6.5"}, {"db_id": "afb53916a223205ed20435542f0bacc1", "kind": "equivalent", "version": "14.24", "label": "14.24", "title": "Update time zone data files to tzdata release 2026c", "evidence": {"same_day": true, "patch_ids": ["b4e9971495e6df3bcbb5661de594cfb5"], "statement_hash": "db30f9e9494e81ad745b38acebea395f96ce2c6e6fd0e722f568326a3b8491a7"}, "url": "/docs/compare/?release=14.24#14.24-14e27d4d0379635b", "source_url": "/docs/release/14.24/#id-1.11.6.6.6"}]}]}], "stats": [{"key": "all", "label": "All changes", "count": 98}, {"key": "feature", "label": "Features", "count": 0}, {"key": "bugfix", "label": "Bug fixes", "count": 42}, {"key": "security", "label": "Security", "count": 29}, {"key": "performance", "label": "Performance", "count": 0}, {"key": "compatibility", "label": "Compatibility", "count": 0}, {"key": "improvement", "label": "Improvements", "count": 27}], "total": 98, "release_count": 1, "cross_major": false, "cve_count": 31, "cves": [{"id": "CVE-2026-6637", "url": "https://www.postgresql.org/support/security/CVE-2026-6637/", "fixed": {"14": "14.23", "15": "15.18", "16": "16.14", "17": "17.10", "18": "18.4"}, "score": 8.8, "title": "Avoid NULL-pointer dereference in contrib/refint's check_foreign_key()", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6637", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "contrib module", "published": {"14": "2026-05-14", "15": "2026-05-14", "16": "2026-05-14", "17": "2026-05-14", "18": "2026-05-14"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Stack buffer overflow in PostgreSQL module \"refint\" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a \"refint\" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "affected_ranges": [{"from": "0", "until": "14.23"}, {"from": "15", "until": "15.18"}, {"from": "16", "until": "16.14"}, {"from": "17", "until": "17.10"}, {"from": "18", "until": "18.4"}], "first_published": "2026-05-14", "fixed_version": "16.14"}, {"id": "CVE-2026-6473", "url": "https://www.postgresql.org/support/security/CVE-2026-6473/", "fixed": {"14": "14.23", "15": "15.18", "16": "16.14", "17": "17.10", "18": "18.4"}, "score": 8.8, "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6473", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-05-14", "15": "2026-05-14", "16": "2026-05-14", "17": "2026-05-14", "18": "2026-05-14"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "affected_ranges": [{"from": "0", "until": "14.23"}, {"from": "15", "until": "15.18"}, {"from": "16", "until": "16.14"}, {"from": "17", "until": "17.10"}, {"from": "18", "until": "18.4"}], "first_published": "2026-05-14", "fixed_version": "16.14"}, {"id": "CVE-2026-19385", "url": "https://www.postgresql.org/support/security/CVE-2026-19385/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Remove pg_dump's assumption that pg_proc.protrftypes cannot have more than FUNC_MAX_ARGS entries", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-19385", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "client", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-18408", "url": "https://www.postgresql.org/support/security/CVE-2026-18408/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-18408", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "client", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \\restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \\restrict and \\unrestrict to block this attack, but \\unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \\restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-16239", "url": "https://www.postgresql.org/support/security/CVE-2026-16239/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Cross-check the output row type of a portal running EXECUTE or FETCH", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-16239", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Type confusion in PostgreSQL \"portal\"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-16238", "url": "https://www.postgresql.org/support/security/CVE-2026-16238/", "fixed": {"18": "18.6"}, "score": 8.8, "title": "Fix multirange type handling in pg_restore_attribute_stats()", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-16238", "affected": {"18": "18"}, "component": "core server", "published": {"18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.", "affected_ranges": [{"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": ""}, {"id": "CVE-2026-15742", "url": "https://www.postgresql.org/support/security/CVE-2026-15742/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Fix integer overflows in contrib/fuzzystrmatch's levenshtein() and levenshtein_less_equal() functions", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-15742", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "contrib module", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_less_equal(). Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-15741", "url": "https://www.postgresql.org/support/security/CVE-2026-15741/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "When deparsing an EXTRACT() function call, quote the field name if needed", "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-15741", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \\sf, and any similar usage in non-core tools. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14680", "url": "https://www.postgresql.org/support/security/CVE-2026-14680/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Reject calls from SQL to functions that take or return type internal", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14680", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Type confusion with PostgreSQL \"internal\" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type \"internal\" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14677", "url": "https://www.postgresql.org/support/security/CVE-2026-14677/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Fix integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14677", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14676", "url": "https://www.postgresql.org/support/security/CVE-2026-14676/", "fixed": {"18": "18.6"}, "score": 8.8, "title": "Fix buffer overrun in contrib/pg_stat_statements", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14676", "affected": {"18": "18"}, "component": "contrib module", "published": {"18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.", "affected_ranges": [{"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": ""}, {"id": "CVE-2026-14671", "url": "https://www.postgresql.org/support/security/CVE-2026-14671/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Remove the plan cache in contrib/refint", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14671", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "contrib module", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Type confusion in PostgreSQL module \"refint\" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject \"refint: Remove plan cache.\", without a CVE number. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14670", "url": "https://www.postgresql.org/support/security/CVE-2026-14670/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Harden PL/Perl against “tied” Perl arrays and hashes", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14670", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14669", "url": "https://www.postgresql.org/support/security/CVE-2026-14669/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Fix buffer overrun with long time zone abbreviation in to_char()", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14669", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14664", "url": "https://www.postgresql.org/support/security/CVE-2026-14664/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Fix buffer overrun in regexp match/split functions", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14664", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14662", "url": "https://www.postgresql.org/support/security/CVE-2026-14662/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.8, "title": "Harden tsvector and tsquery code against overly long values (both individual lexemes and total vector/query length)", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14662", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2025-8714", "url": "https://www.postgresql.org/support/security/CVE-2025-8714/", "fixed": {"13": "13.22", "14": "14.19", "15": "15.14", "16": "16.10", "17": "17.6"}, "score": 8.8, "title": "Do not do backquote expansion on the argument of psql's \\unrestrict command", "vector": "AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2025-8714", "affected": {"13": "13", "14": "14", "15": "15", "16": "16", "17": "17"}, "component": "core server", "published": {"13": "2025-08-14", "14": "2025-08-14", "15": "2025-08-14", "16": "2025-08-14", "17": "2025-08-14"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. This is similar to MySQL CVE-2024-21096. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.", "affected_ranges": [{"from": "0", "until": "13.22"}, {"from": "14", "until": "14.19"}, {"from": "15", "until": "15.14"}, {"from": "16", "until": "16.10"}, {"from": "17", "until": "17.6"}], "first_published": "2025-08-14", "fixed_version": "16.10"}, {"id": "CVE-2026-14679", "url": "https://www.postgresql.org/support/security/CVE-2026-14679/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.2, "title": "Fix various places that mistakenly assumed they would not have to deal with more than FUNC_MAX_ARGS function arguments", "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14679", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-6464", "url": "https://www.postgresql.org/support/security/CVE-2026-6464/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.1, "title": "Fix psql to skip in-line data following a scripted COPY ... FROM STDIN command, even if the COPY fails before sending PGRES_COPY_IN", "vector": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6464", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "client", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the \"COPY FROM STDIN\" or \"\\copy FROM STDIN\" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. \"COPY FROM\" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14668", "url": "https://www.postgresql.org/support/security/CVE-2026-14668/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 8.1, "title": "Make scalarineqsel() check that a constant it expects to be of type tid actually is", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14668", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-6471", "url": "https://www.postgresql.org/support/security/CVE-2026-6471/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 7.2, "title": "Restrict logical decoding output plugins to the set specified by a new server parameter output_plugin_libraries", "vector": "AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6471", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary code as that account. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14663", "url": "https://www.postgresql.org/support/security/CVE-2026-14663/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 6.5, "title": "Fix contrib/pgcrypto's PGP encryption to detect unsupported ciphers", "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14663", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "contrib module", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the modest protection from the Modification Detection Code (MDC). Affected functions are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14672", "url": "https://www.postgresql.org/support/security/CVE-2026-14672/", "fixed": {"16": "16.15", "17": "17.11", "18": "18.6"}, "score": 5.3, "title": "Make mock SCRAM authentication secrets more plausible", "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14672", "affected": {"16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.6, 17.11, and 16.15 are affected. Versions before PostgreSQL 16 are unaffected.", "affected_ranges": [{"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-6470", "url": "https://www.postgresql.org/support/security/CVE-2026-6470/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 4.3, "title": "Check for USAGE privilege on data types in places that formerly failed to check that", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6470", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-18024", "url": "https://www.postgresql.org/support/security/CVE-2026-18024/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 4.3, "title": "Harden the ascii() function against invalid input", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-18024", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14678", "url": "https://www.postgresql.org/support/security/CVE-2026-14678/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 4.3, "title": "Fix datatype error in contrib/pg_trgm's GiST picksplit function", "vector": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14678", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "contrib module", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14681", "url": "https://www.postgresql.org/support/security/CVE-2026-14681/", "fixed": {"17": "17.11", "18": "18.6"}, "score": 4.2, "title": "Reject GSSEncRequest after direct SSL connection", "vector": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14681", "affected": {"17": "17", "18": "18"}, "component": "core server", "published": {"17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.6 and 17.11 are affected. Versions before PostgreSQL 17 are unaffected.", "affected_ranges": [{"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": ""}, {"id": "CVE-2026-14666", "url": "https://www.postgresql.org/support/security/CVE-2026-14666/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 4.2, "title": "Invalidate role-dependent cached plans after role changes", "vector": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14666", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application's pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-6469", "url": "https://www.postgresql.org/support/security/CVE-2026-6469/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 3.8, "title": "Preserve the ownership of extended statistics objects when they are rebuilt by ALTER TABLE", "vector": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-6469", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "core server", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper ownership. It wrongly denies those commands to the prior statistics object owner. DROP TABLE remains able to remove statistics objects, so this exploit achieves nothing in many ownership arrangements. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-16241", "url": "https://www.postgresql.org/support/security/CVE-2026-16241/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "17": "17.11", "18": "18.6"}, "score": 3.8, "title": "Fix out-of-bounds writes in ecpg applications caused by invalid bytea data received from the server", "vector": "AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-16241", "affected": {"14": "14", "15": "15", "16": "16", "17": "17", "18": "18"}, "component": "client", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "17": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes outside attacker knowledge or control. This typically yields a simple SIGSEGV, but rare cases might achieve client-specific integrity impact via the write. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "17", "until": "17.11"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}, {"id": "CVE-2026-14673", "url": "https://www.postgresql.org/support/security/CVE-2026-14673/", "fixed": {"14": "14.24", "15": "15.19", "16": "16.15", "18": "18.6"}, "score": 3.8, "title": "Ensure that contrib/amcheck functions restrict search_path before executing index expressions", "vector": "AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "cna_url": "https://cveawg.mitre.org/api/cve/CVE-2026-14673", "affected": {"14": "14", "15": "15", "16": "16", "18": "18"}, "component": "contrib module", "published": {"14": "2026-08-13", "15": "2026-08-13", "16": "2026-08-13", "18": "2026-08-13"}, "introduced": {}, "cvss_version": "3.0", "description_en": "Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.", "affected_ranges": [{"from": "0", "until": "14.24"}, {"from": "15", "until": "15.19"}, {"from": "16", "until": "16.15"}, {"from": "18", "until": "18.6"}], "first_published": "2026-08-13", "fixed_version": "16.15"}], "cve_available": true, "remaining_cves": [], "security_regressions": [], "warnings": [], "candidate_count": 98, "already_in_source_count": 0, "duplicate_count": 0, "excluded_count": 0, "exclusions": [], "source_as_of": "2026-09-26", "security_as_of": "2026-09-26"}