PostgreSQL patches 52 flaws, including a type confusion bug enabling code execution
Administrators running affected releases should update the server and rebuild C-language extensions, since the fix is incomplete without them.
PostgreSQL's latest minor releases patch 52 security flaws, the most serious being CVE-2026-6460, a type confusion bug with a CVSS score of 8.8 that lets an authenticated user who can create objects run code with the privileges of the database's operating system account. The flaw arises when a composite type's field is altered while older values of that type remain in memory, allowing the server to read an old value as if it had the new type, and it affects releases before 18.7, 17.12, 16.16, 15.20 and 14.25. The PostgreSQL project and CISA report no known exploitation, but a researcher has demonstrated a crash and memory-address leak on 18.6 and has privately shared proofs of concept with managed service providers including AWS, Microsoft, Google, Supabase, Databricks and Ubicloud. Administrators are advised to update the server, rebuild C-language extensions at the same time, and update client tools such as pg_dump and pg_restore, since fixes there address code execution from crafted archives.
Why it matters
The most serious flaw lets a user who can create objects run code with the privileges of the database's operating system account, and a researcher has already shown a crash and memory-address leak on PostgreSQL 18.6. Although the project and CISA report no known exploitation, managed service providers including AWS, Microsoft, Google, Supabase, Databricks and Ubicloud have received proofs of concept privately. For anyone running PostgreSQL on shared or hosted infrastructure, that means the window between disclosure and widespread patching is the period that matters most.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.