PostgreSQL 14.20 → 14.21
1 release · 0 breaking changes · 4 security fixes · 4 advisories fixed
4security0breaking0deprecated6feature18fix
Vulnerabilities fixed by this upgrade
- 4.3 CVE-2026-2003 Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confi…
- 8.8 CVE-2026-2004 Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the datab…
- 8.8 CVE-2026-2005 Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12,…
- 8.8 CVE-2026-2006 Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary c…
Breaking changes
None in the release notes.
Security changes
- security Guard against unexpected dimensions of oidvector/int2vector (Tom Lane) These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without… in 14.21
- security Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type.… in 14.21
- security Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for… in 14.21
- security Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for… in 14.21
Every release in between
securityGuard against unexpected dimensions of oidvector/int2vector (Tom Lane) These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without…
securityHarden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type.…
securityFix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for…
securityFix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for…
featureDon't allow CTE references in sub-selects to determine semantic levels of aggregate functions (Tom Lane) This change undoes a change made two minor releases ago, instead throwing an error if a sub-select references a CTE that's below the semantic level that standard SQL rules would assign to the…
fixFix failure when all children of a partitioned target table of an update or delete have been pruned (Amit Langote) In such cases, the executor could report “could not find junk ctid column” errors, even though nothing needs to be done.
featureAllow indexscans on partial hash indexes even when the index's predicate implies the truth of the WHERE clause (Tom Lane) Normally we drop a WHERE clause that is implied by the predicate, since it's pointless to test it; it must hold for every index entry. However that can prevent creation of an…
fixDo not emit WAL for unlogged BRIN indexes (Kirill Reshke) One seldom-taken code path incorrectly emitted a WAL record relating to a BRIN index even if the index was marked unlogged. Crash recovery would then fail to replay that record, complaining that the file already exists.
otherPrevent truncation of CLOG that is still needed by unread NOTIFY messages (Joel Jacobson, Heikki Linnakangas) This fix prevents “could not access status of transaction” errors when a backend is slow to absorb NOTIFY messages.
featureEscalate errors occurring during NOTIFY message processing to FATAL, i.e. close the connection (Heikki Linnakangas) Formerly, if a backend got an error while absorbing a NOTIFY message, it would advance past that message, report the error to the client, and move on. That behavior was fraught with…
fixFix bug in following update chain when locking a tuple (Jasper Smit) This code path neglected to check the xmin of the first new tuple in the update chain, making it possible to lock an unrelated tuple if the original updater aborted and the space was immediately reclaimed by VACUUM and then…
fixFix issues around in-place catalog updates (Noah Misch) Send a nontransactional invalidation message for an in-place update, since such an update will survive transaction rollback. Also ensure that the update is WAL-logged before other sessions can see it. These fixes primarily prevent scenarios…
fixFix potential backend process crash at process exit due to trying to release a lock in an already-unmapped shared memory segment (Rahila Syed)
fixGuard against incorrect truncation of the multixact log after a crash (Heikki Linnakangas)
fixFix possibly mis-encoded result of pg_stat_get_backend_activity() (Chao Li) The shared-memory buffer holding a session's activity string can end with an incomplete multibyte character. Readers are supposed to truncate off any such incomplete character, but this function failed to do so.
otherGuard against recursive memory context logging (Fujii Masao) A constant flow of signals requesting memory context logging could cause recursive execution of the logging code, which in theory could lead to stack overflow.
fixFix memory context usage when reinitializing a parallel execution context (Jakub Wartak, Jeevan Chalke) This error could result in a crash due to a subsidiary data structure having a shorter lifespan than the parallel context. The problem is not known to be reachable using only core PostgreSQL,…
featureSet next multixid's offset when creating a new multixid, to remove the wait loop that was needed in corner cases (Andrey Borodin) The previous logic could get stuck waiting for an update that would never occur.
otherAvoid rewriting data-modifying CTEs more than once (Bernice Southey, Dean Rasheed) Formerly, when updating an auto-updatable view or a relation with rules, if the original query had any data-modifying CTEs, the rewriter would rewrite those CTEs multiple times due to recursion. This was inefficient…
fixFail recovery if WAL does not exist back to the redo point indicated by the checkpoint record (Nitin Jadhav) Add an explicit check for this before starting recovery, so that no harm is done and a useful error message is provided. Previously, recovery might crash or corrupt the database in this…
otherAvoid scribbling on the source query tree during ALTER PUBLICATION (Sunil S) This error had the visible effect that an event trigger fired for the query would see only the first publish option, even if several had been specified. If such a query were set up as a prepared statement, re-executions…
featurePrevent invalidation of newly created or newly synced replication slots (Zhijie Hou) A race condition with a concurrent checkpoint could allow WAL to be removed that is needed by the replication slot, causing the slot to immediately get marked invalid.
fixFix race condition in computing a replication slot's required xmin (Zhijie Hou) This could lead to the error “cannot build an initial slot snapshot as oldest safe xid follows snapshot's xmin”.
featureDuring initial synchronization of a logical replication subscription, commit the addition of a pg_replication_origin entry before starting to copy data (Zhijie Hou) Previously, if the copy step failed, the new pg_replication_origin entry would be lost due to transaction rollback. This led to…
fixFix possible failure with “unexpected data beyond EOF” during restart of a streaming replica server (Anthonin Bonnefoy)
fixFix erroneous tracking of column position when parsing partition range bounds (myzhen) This could, for example, lead to the wrong column name being cited in error messages about casting partition bound values to the column's data type.
fixFix assorted minor errors in error messages (Man Zeng, Tianchen Zhang) For example, an error report about mismatched timeline number in a backup manifest showed the starting timeline number where it meant to show the ending timeline number.
fixFix failure to perform function inlining when doing JIT compilation with LLVM version 17 or later (Anthonin Bonnefoy)
otherAdjust our JIT code to work with LLVM 21 (Holger Hoffstätte) The previous coding failed to compile on aarch64 machines.
otherSupport process title changes on GNU/Hurd (Michael Banck)
otherMake pg_resetwal print the updated value when changing OldestXID (Heikki Linnakangas) It already did that for every other variable it can change.
otherIn contrib/amcheck, use the correct snapshot for btree index parent checks (Mihail Nikalayeu) The previous coding caused spurious errors when examining indexes created with CREATE INDEX CONCURRENTLY.
fixFix contrib/amcheck to handle “half-dead” btree index pages correctly (Heikki Linnakangas) amcheck expected such a page to have a parent downlink, but it does not, leading to a false error report about “mismatch between parent key and child high key”.
fixFix contrib/amcheck to handle incomplete btree root page splits correctly (Heikki Linnakangas) amcheck could report a false error about “block is not true root”.
fixFix edge-case integer overflow in contrib/intarray's selectivity estimator for @@ (Chao Li) This could cause poor selectivity estimates to be produced for cases involving the maximum integer value.
fixFix multibyte-encoding issue in contrib/ltree (Jeff Davis) The previous coding could pass an incomplete multibyte character to lower(), probably resulting in incorrect behavior.
otherUpdate time zone data files to tzdata release 2025c (Tom Lane) The only change is in historical data for pre-1976 timestamps in Baja California.