PostgreSQL 14.8 → 14.12
4 releases · 8 breaking changes · 11 security fixes · 6 advisories fixed
11security8breaking2deprecated18feature78fix
Vulnerabilities fixed by this upgrade
- 3.1 CVE-2024-4317 Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS co…
- 8.0 CVE-2024-0985 Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functio…
- 4.3 CVE-2023-5868 A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Hand…
- 8.8 CVE-2023-5869 A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an in…
- 2.2 CVE-2023-5870 A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Suc…
- 7.5 CVE-2023-39417 IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an a…
Breaking changes
- breaking Avoid deadlock during removal of orphaned temporary tables (Mikhail Zhilin) If the session that creates a temporary table crashes without removing the table, autovacuum will eventually try to remove the orphaned table. However, an incoming session that's been assigned the same temporary namespace… in 14.12
- breaking Fix incompatibility with LLVM 18 (Thomas Munro, Dmitry Dolgov) in 14.12
- breaking Fix incompatibility with OpenSSL 3.2 (Tristan Partin, Bo Andreson) Use the BIO “app_data” field for our private storage, instead of assuming it's okay to use the “data” field. This mistake didn't cause problems before, but with 3.2 it leads to crashes and complaints about double frees. in 14.11
- breaking Remove incorrect assertion in PL/Python exception handling (Alexander Lakhin) in 14.10
- breaking Add logic to pg_upgrade to check for use of abstime, reltime, and tinterval data types (Álvaro Herrera) These obsolete data types were removed in PostgreSQL version 12, so check to make sure they aren't present in an older database before claiming it can be upgraded. in 14.10
- breaking Remove PHOT (Phoenix Islands Time) from the default timezone abbreviations list (Tom Lane) Presence of this abbreviation in the default list can cause failures on recent Debian and Ubuntu releases, as they no longer install the underlying tzdb entry by default. Since this is a made-up abbreviation… in 14.10
- breaking Avoid leaving a corrupted database behind when DROP DATABASE is interrupted (Andres Freund) If DROP DATABASE was interrupted after it had already begun taking irreversible steps, the target database remained accessible (because the removal of its pg_database row would roll back), but it would have… in 14.9
- breaking Avoid producing incorrect plans for foreign joins with pseudoconstant join clauses (Etsuro Fujita) The planner currently lacks support for attaching pseudoconstant join clauses to a pushed-down remote join, so disable generation of remote joins in such cases. (A better solution will require… in 14.9
Security changes
- security Restrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner (Nathan Bossart) These views failed to hide statistics for expressions that involve columns the accessing user does not have permission to read. View columns such as most_common_vals might expose… in 14.12
- security Find the SQL script fix-CVE-2024-4317.sql in the share directory of the PostgreSQL installation (typically located someplace like /usr/share/postgresql/). Be sure to use the script appropriate to your PostgreSQL major version. If you do not see this file, either your version is not vulnerable… in 14.12
- security In each database of the cluster, run the fix-CVE-2024-4317.sql script as superuser. In psql this would look like \i /usr/share/postgresql/fix-CVE-2024-4317.sql (adjust the file path as appropriate). Any error probably indicates that you've used the wrong script version. It will not hurt to run the… in 14.12
- security Do not forget to include the template0 and template1 databases, or the vulnerability will still exist in databases you create later. To fix template0, you'll need to temporarily make it accept connections. Do that with ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true; and then after fixing… in 14.12
- security Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (Heikki Linnakangas) One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent… in 14.11
- security In pg_dump, don't dump RLS policies or security labels for extension member objects (Tom Lane, Jacob Champion) Previously, commands would be included in the dump to set these properties, which is really incorrect since they should be considered as internal affairs of the extension. Moreover, the… in 14.11
- security Fix handling of unknown-type arguments in DISTINCT "any" aggregate functions (Tom Lane) This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value. The… in 14.10
- security Detect integer overflow while computing new array dimensions (Tom Lane) When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution… in 14.10
- security Prevent the pg_signal_backend role from signalling background workers and autovacuum processes (Noah Misch, Jelte Fennema-Nio) The documentation says that pg_signal_backend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they… in 14.10
- security Disallow substituting a schema or owner name into an extension script if the name contains a quote, backslash, or dollar sign (Noah Misch) This restriction guards against SQL-injection hazards for trusted extensions. The PostgreSQL Project thanks Micah Gates, Valerie Woolard, Tim Carey-Smith, and… in 14.9
- security Correctly handle sub-SELECTs in RLS policy expressions and security-barrier views when expanding rule actions (Tom Lane) in 14.9
Deprecations
- deprecated In contrib/xml2, avoid use of library functions that have been deprecated in recent versions of libxml2 (Dmitry Koval) in 14.12
- deprecated Avoid deprecation warning when compiling with LLVM 18 (Thomas Munro) in 14.11
Every release in between
securityRestrict visibility of pg_stats_ext and pg_stats_ext_exprs entries to the table owner (Nathan Bossart) These views failed to hide statistics for expressions that involve columns the accessing user does not have permission to read. View columns such as most_common_vals might expose…
securityFind the SQL script fix-CVE-2024-4317.sql in the share directory of the PostgreSQL installation (typically located someplace like /usr/share/postgresql/). Be sure to use the script appropriate to your PostgreSQL major version. If you do not see this file, either your version is not vulnerable…
securityIn each database of the cluster, run the fix-CVE-2024-4317.sql script as superuser. In psql this would look like \i /usr/share/postgresql/fix-CVE-2024-4317.sql (adjust the file path as appropriate). Any error probably indicates that you've used the wrong script version. It will not hurt to run the…
securityDo not forget to include the template0 and template1 databases, or the vulnerability will still exist in databases you create later. To fix template0, you'll need to temporarily make it accept connections. Do that with ALTER DATABASE template0 WITH ALLOW_CONNECTIONS true; and then after fixing…
fixFix INSERT from multiple VALUES rows into a target column that is a domain over an array or composite type (Tom Lane) Such cases would either fail with surprising complaints about mismatched datatypes, or insert unexpected coercions that could lead to odd results.
fixFix incorrect pruning of NULL partition when a table is partitioned on a boolean column and the query has a boolean IS NOT clause (David Rowley) A NULL value satisfies a clause such as boolcol IS NOT FALSE, so pruning away a partition containing NULLs yielded incorrect answers.
featureMake ALTER FOREIGN TABLE SET SCHEMA move any owned sequences into the new schema (Tom Lane) Moving a regular table to a new schema causes any sequences owned by the table to be moved to that schema too (along with indexes and constraints). This was overlooked for foreign tables, however.
otherImprove ALTER TABLE ... ALTER COLUMN TYPE's error message when there is a dependent function or publication (Tom Lane)
fixFix EXPLAIN's counting of heap pages accessed by a bitmap heap scan (Melanie Plageman) Previously, heap pages that contain no visible tuples were not counted; but it seems more consistent to count all pages returned by the bitmap index scan.
breakingAvoid deadlock during removal of orphaned temporary tables (Mikhail Zhilin) If the session that creates a temporary table crashes without removing the table, autovacuum will eventually try to remove the orphaned table. However, an incoming session that's been assigned the same temporary namespace…
otherAvoid race condition while examining per-relation frozen-XID values (Noah Misch) VACUUM's computation of per-database frozen-XID values from per-relation values could get confused by a concurrent update of those values by another VACUUM.
fixDisallow converting a table to a view within an outer SQL command that is using that table (Tom Lane) This avoids possible crashes.
otherEnsure that join conditions generated from equivalence classes are applied at the correct plan level (Tom Lane) In versions before PostgreSQL 16, it was possible for generated conditions to be evaluated below outer joins when they should be evaluated above (after) the outer join, leading to…
otherAvoid unnecessary use of moving-aggregate mode with a non-moving window frame (Vallimaharajan G) When a plain aggregate is used as a window function, and the window frame start is specified as UNBOUNDED PRECEDING, the frame's head cannot move so we do not need to use the special (and more…
fixAvoid use of already-freed data while planning partition-wise joins under GEQO (Tom Lane) This would typically end in a crash or unexpected error message.
otherAvoid freeing still-in-use data in Memoize (Tender Wang, Andrei Lepikhov) In production builds this error frequently didn't cause any problems, as the freed data would most likely not get overwritten before it was used.
fixFix incorrectly-reported statistics kind codes in “requested statistics kind X is not yet built” error messages (David Rowley)
otherBe more careful with RECORD-returning functions in FROM (Tom Lane) The output columns of such a function call must be defined by an AS clause that specifies the column names and data types. If the actual function output value doesn't match that, an error is supposed to be thrown at runtime.…
fixFix confusion about the return rowtype of SQL-language procedures (Tom Lane) A procedure implemented in SQL language that returns a single composite-type column would cause an assertion failure or core dump.
featureAdd protective stack depth checks to some recursive functions (Egor Chindyaskin)
fixFix mis-rounding and overflow hazards in date_bin() (Moaaz Assali) In the case where the source timestamp is before the origin timestamp and their difference is already an exact multiple of the stride, the code incorrectly subtracted the stride anyway. Also, detect some integer-overflow cases that…
otherDetect integer overflow when adding or subtracting an interval to/from a timestamp (Joseph Koshakow) Some cases that should cause an out-of-range error produced an incorrect result instead.
otherAvoid race condition in pg_get_expr() (Tom Lane) If the relation referenced by the argument is dropped concurrently, the function's intention is to return NULL, but sometimes it failed instead.
fixFix detection of old transaction IDs in XID status functions (Karina Litskevich) Transaction IDs more than 231 transactions in the past could be misidentified as recent, leading to misbehavior of pg_xact_status() or txid_status().
fixEnsure that a table's freespace map won't return a page that's past the end of the table (Ronan Dunklau) Because the freespace map isn't WAL-logged, this was possible in edge cases involving an OS crash, a replica promote, or a PITR restore. The result would be a “could not read block” error.
fixFix file descriptor leakage when an error is thrown while waiting in WaitEventSetWait (Etsuro Fujita)
featureAvoid corrupting exception stack if an FDW implements async append but doesn't configure any wait conditions for the Append plan node to wait for (Alexander Pyhalov)
otherThrow an error if an index is accessed while it is being reindexed (Tom Lane) Previously this was just an assertion check, but promote it into a regular runtime error. This will provide a more on-point error message when reindexing a user-defined index expression that attempts to access its own…
fixEnsure that index-only scans on name columns return a fully-padded value (David Rowley) The value physically stored in the index is truncated, and previously a pointer to that value was returned to callers. This provoked complaints when testing under valgrind. In theory it could result in crashes,…
fixFix crash with DSM allocations larger than 4GB (Heikki Linnakangas)
featureDisconnect if a new server session's client socket cannot be put into non-blocking mode (Heikki Linnakangas) It was once theoretically possible for us to operate with a socket that's in blocking mode; but that hasn't worked fully in a long time, so fail at connection start rather than misbehave…
fixFix inadequate error reporting with OpenSSL 3.0.0 and later (Heikki Linnakangas, Tom Lane) System-reported errors passed through by OpenSSL were reported with a numeric error code rather than anything readable.
featureAvoid concurrent calls to bindtextdomain() in libpq and ecpglib (Tom Lane) Although GNU gettext's implementation seems to be fine with concurrent calls, the version available on Windows is not.
fixFix crash in ecpg's preprocessor if the program tries to redefine a macro that was defined on the preprocessor command line (Tom Lane)
fixFix pg_dumpall so that role comments, if present, will be dumped regardless of the setting of --no-role-passwords (Daniel Gustafsson, Álvaro Herrera)
fixFix PL/pgSQL's parsing of single-line comments (---style comments) following expressions (Erik Wienhold, Tom Lane) This mistake caused parse errors if such a comment followed a WHEN expression in a PL/pgSQL CASE statement.
fixFix bugs in BRIN output functions (Tomas Vondra) These output functions are only used for displaying index entries in contrib/pageinspect, so the errors are of limited practical concern.
deprecatedIn contrib/xml2, avoid use of library functions that have been deprecated in recent versions of libxml2 (Dmitry Koval)
breakingFix incompatibility with LLVM 18 (Thomas Munro, Dmitry Dolgov)
featureAllow make check to work with the musl C library (Thomas Munro, Bruce Momjian, Tom Lane)
+5 more items in the release notessecurityTighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY (Heikki Linnakangas) One step of a concurrent refresh command was run under weak security restrictions. If a materialized view's owner could persuade a superuser or other high-privileged user to perform a concurrent…
fixFix memory leak when performing JIT inlining (Andres Freund, Daniel Gustafsson) There have been multiple reports of backend processes suffering out-of-memory conditions after sufficiently many JIT compilations. This fix should resolve that.
otherWhen dequeueing from an LWLock, avoid needing to search the list of waiting processes (Andres Freund) This fixes O(N^2) behavior when the list of waiters is long. In some use-cases this results in substantial throughput improvements.
fixAvoid generating incorrect partitioned-join plans (Richard Guo) Some uncommon situations involving lateral references could create incorrect plans. Affected queries could produce wrong answers, or odd failures such as “variable not found in subplan target list”, or executor crashes.
fixFix incorrect wrapping of subquery output expressions in PlaceHolderVars (Tom Lane) This fixes incorrect results when a subquery is underneath an outer join and has an output column that laterally references something outside the outer join's scope. The output column might not appear as NULL when…
featurePrevent access to a no-longer-pinned buffer in BEFORE ROW UPDATE triggers (Alexander Lakhin, Tom Lane) If the tuple being updated had just been updated and moved to another page by another session, there was a narrow window where we would attempt to fetch data from the new tuple version without…
otherAvoid requesting an oversize shared-memory area in parallel hash join (Thomas Munro, Andrei Lepikhov, Alexander Korotkov) The limiting value was too large, allowing “invalid DSA memory alloc request size” errors to occur with sufficiently large expected hash table sizes.
otherAvoid assertion failures in heap_update() and heap_delete() when a tuple to be updated by a foreign-key enforcement trigger fails the extra visibility crosscheck (Alexander Lakhin) This error had no impact in non-assert builds.
fixFix overly tight assertion about false_positive_rate parameter of BRIN bloom operator classes (Alexander Lakhin) This error had no impact in non-assert builds, either.
fixFix possible failure during ALTER TABLE ADD COLUMN on a complex inheritance tree (Tender Wang) If a grandchild table would inherit the new column via multiple intermediate parents, the command failed with “tuple already updated by self”.
fixFix problems with duplicate token names in ALTER TEXT SEARCH CONFIGURATION ... MAPPING commands (Tender Wang, Michael Paquier)
otherProperly lock the associated table during DROP STATISTICS (Tomas Vondra) Failure to acquire the lock could result in “tuple concurrently deleted” errors if the DROP executes concurrently with ANALYZE.
fixFix function volatility checking for GENERATED and DEFAULT expressions (Tom Lane) These places could fail to detect insertion of a volatile function default-argument expression, or decide that a polymorphic function is volatile although it is actually immutable on the datatype of interest. This…
featureDetect that a new catalog cache entry became stale while detoasting its fields (Tom Lane) We expand any out-of-line fields in a catalog tuple before inserting it into the catalog caches. That involves database access which might cause invalidation of catalog cache entries — but the new entry isn't…
fixFix edge-case integer overflow detection bug on some platforms (Dean Rasheed) Computing 0 - INT64_MIN should result in an overflow error, and did on most platforms. However, platforms with neither integer overflow builtins nor 128-bit integers would fail to spot the overflow, instead returning…
otherDetect Julian-date overflow when adding or subtracting an interval to/from a timestamp (Tom Lane) Some cases that should cause an out-of-range error produced an incorrect result instead.
featureAdd more checks for overflow in interval_mul() and interval_div() (Dean Rasheed) Some cases that should cause an out-of-range error produced an incorrect result instead.
otherMake the pg_file_settings view check validity of unapplied values for settings with backend or superuser-backend context (Tom Lane) Invalid values were not noted in the view as intended. This escaped detection because there are very few settings in these groups.
featureMatch collation too when matching an existing index to a new partitioned index (Peter Eisentraut) Previously we could accept an index that has a different collation from the corresponding element of the partition key, possibly leading to misbehavior.
otherAvoid failure if a child index is dropped concurrently with REINDEX INDEX on a partitioned index (Fei Changhong)
fixFix insufficient locking when cleaning up an incomplete split of a GIN index's internal page (Fei Changhong, Heikki Linnakangas) The code tried to do this with shared rather than exclusive lock on the buffer. This could lead to index corruption if two processes attempted the cleanup concurrently.
otherAvoid premature release of buffer pin in GIN index insertion (Tom Lane) If an index root page split occurs concurrently with our own insertion, the code could fail with “buffer NNNN is not owned by resource owner”.
otherAvoid failure with partitioned SP-GiST indexes (Tom Lane) Trying to use an index of this kind could lead to “No such file or directory” errors.
fixFix ownership change reporting for large objects (Tom Lane) A no-op ALTER LARGE OBJECT OWNER command (that is, one selecting the existing owner) passed the wrong class ID to the PostAlterHook, probably confusing any extension using that hook.
featurePrevent standby servers from incorrectly processing dead index tuples during subtransactions (Fei Changhong) The startedInRecovery flag was not correctly set for a subtransaction. This affects only processing of dead index tuples. It could allow a query in a subtransaction to ignore index entries…
fixFix deadlock between a logical replication apply worker, its tablesync worker, and a session process trying to alter the subscription (Shlok Kyal) One edge of the deadlock loop did not involve a lock wait, so the deadlock went undetected and would persist until manual intervention.
otherPrevent examining system catalogs with the wrong snapshot during logical decoding (Fei Changhong) If decoding begins partway through a transaction that modifies system catalogs, the decoder may not recognize that, causing it to fail to treat that transaction as in-progress for catalog lookups.…
featureReturn the correct status code when a new client disconnects without responding to the server's password challenge (Liu Lang, Tom Lane) In some cases we'd treat this as a loggable error, which was not the intention and tends to create log spam, since common clients like psql frequently do this. It…
breakingFix incompatibility with OpenSSL 3.2 (Tristan Partin, Bo Andreson) Use the BIO “app_data” field for our private storage, instead of assuming it's okay to use the “data” field. This mistake didn't cause problems before, but with 3.2 it leads to crashes and complaints about double frees.
otherBe more wary about OpenSSL not setting errno on error (Tom Lane) If errno isn't set, assume the cause of the reported failure is read EOF. This fixes rare cases of strange error reports like “could not accept SSL connection: Success”.
fixFix file descriptor leakage when a foreign data wrapper's ForeignAsyncRequest function fails (Heikki Linnakangas)
otherReport ENOMEM errors from file-related system calls as ERRCODE_OUT_OF_MEMORY, not ERRCODE_INTERNAL_ERROR (Alexander Kuzmenkov)
otherIn PL/pgSQL, support SQL commands that are CREATE FUNCTION/CREATE PROCEDURE with SQL-standard bodies (Tom Lane) Previously, such cases failed with parsing errors due to the semicolon(s) appearing in the function body.
fixFix libpq's handling of errors in pipelines (Álvaro Herrera) The pipeline state could get out of sync if an error is returned for reasons other than a query problem (for example, if the connection is lost). Potentially this would lead to a busy-loop in the calling application.
fixFix timing-dependent failure in GSSAPI data transmission (Tom Lane) When using GSSAPI encryption in non-blocking mode, libpq sometimes failed with “GSSAPI caller failed to retransmit all data needing to be retried”.
securityIn pg_dump, don't dump RLS policies or security labels for extension member objects (Tom Lane, Jacob Champion) Previously, commands would be included in the dump to set these properties, which is really incorrect since they should be considered as internal affairs of the extension. Moreover, the…
fixFix crash in contrib/intarray if an array with an element equal to INT_MAX is inserted into a gist__int_ops index (Alexander Lakhin, Tom Lane)
fixFix compilation failures with libxml2 version 2.12.0 and later (Tom Lane)
fixFix compilation failure of WAL_DEBUG code on Windows (Bharath Rupireddy)
deprecatedAvoid deprecation warning when compiling with LLVM 18 (Thomas Munro)
+9 more items in the release notessecurityFix handling of unknown-type arguments in DISTINCT "any" aggregate functions (Tom Lane) This error led to a text-type value being interpreted as an unknown-type value (that is, a zero-terminated string) at runtime. This could result in disclosure of server memory following the text value. The…
securityDetect integer overflow while computing new array dimensions (Tom Lane) When assigning new elements to array subscripts that are outside the current array bounds, an undetected integer overflow could occur in edge cases. Memory stomps that are potentially exploitable for arbitrary code execution…
securityPrevent the pg_signal_backend role from signalling background workers and autovacuum processes (Noah Misch, Jelte Fennema-Nio) The documentation says that pg_signal_backend cannot issue signals to superuser-owned processes. It was able to signal these background processes, though, because they…
fixFix misbehavior during recursive page split in GiST index build (Heikki Linnakangas) Fix a case where the location of a page downlink was incorrectly tracked, and introduce some logic to allow recovering from such situations rather than silently doing the wrong thing. This error could result in…
otherPrevent de-duplication of btree index entries for interval columns (Noah Misch) There are interval values that are distinguishable but compare equal, for example 24:00:00 and 1 day. This breaks assumptions made by btree de-duplication, so interval columns need to be excluded from de-duplication.…
otherProcess date values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) The distance calculation for dates was backward, causing poor decisions about which entries to merge. The index still produces correct results, but is much less efficient than it should be. Reindexing BRIN…
otherProcess large timestamp and timestamptz values more sanely in BRIN datetime_minmax_multi_ops indexes (Tomas Vondra) Infinities were mistakenly treated as having distance zero rather than a large distance from other values, causing poor decisions about which entries to merge. Also,…
fixAvoid calculation overflows in BRIN interval_minmax_multi_ops indexes with extreme interval values (Tomas Vondra) This bug might have caused unexpected failures while trying to insert large interval values into such an index.
fixFix partition step generation and runtime partition pruning for hash-partitioned tables with multiple partition keys (David Rowley) Some cases involving an IS NULL condition on one of the partition keys could result in a crash.
otherCorrectly identify the target table in an inherited UPDATE/DELETE/MERGE even when the parent table is excluded by constraints (Amit Langote, Tom Lane) If the initially-named table is excluded by constraints, but not all its inheritance descendants are, the first non-excluded descendant was…
fixFix edge case in btree mark/restore processing of ScalarArrayOpExpr clauses (Peter Geoghegan) When restoring an indexscan to a previously marked position, the code could miss required setup steps if the scan had advanced exactly to the end of the matches for a ScalarArrayOpExpr (that is, an…
fixFix intra-query memory leak in Memoize execution (Orlov Aleksej, David Rowley)
fixFix intra-query memory leak when a set-returning function repeatedly returns zero rows (Tom Lane)
fixDon't crash if cursor_to_xmlschema() is applied to a non-data-returning Portal (Boyu Yang)
otherThrow the intended error if pgrowlocks() is applied to a partitioned table (David Rowley) Previously, a not-on-point complaint “only heap AM is supported” would be raised.
otherHandle invalid indexes more cleanly in assorted SQL functions (Noah Misch) Report an error if pgstatindex(), pgstatginindex(), pgstathashindex(), or pgstattuple() is applied to an invalid index. If brin_desummarize_range(), brin_summarize_new_values(), brin_summarize_range(), or…
otherAvoid premature memory allocation failure with long inputs to to_tsvector() (Tom Lane)
fixFix over-allocation of the constructed tsvector in tsvectorrecv() (Denis Erokhin) If the incoming vector includes position data, the binary receive function left wasted space (roughly equal to the size of the position data) in the finished tsvector. In extreme cases this could lead to “maximum…
fixFix incorrect coding in gtsvector_picksplit() (Alexander Lakhin) This could lead to poor page-split decisions in GiST indexes on tsvector columns.
otherImprove checks for corrupt PGLZ compressed data (Flavien Guedez)
fixFix COMMIT AND CHAIN/ROLLBACK AND CHAIN to work properly when there is an unreleased savepoint (Liu Xiang, Tom Lane) Instead of propagating the current transaction's properties to the new transaction, they propagated some previous transaction's properties.
otherIn COPY FROM, fail cleanly when an unsupported encoding conversion is needed (Tom Lane) Recent refactoring accidentally removed the intended error check for this, such that it ended in “cache lookup failed for function 0” instead of a useful error message.
fixAvoid crash in EXPLAIN if a parameter marked to be displayed by EXPLAIN has a NULL boot-time value (Xing Guo, Aleksander Alekseev, Tom Lane) No built-in parameter fits this description, but an extension could define such a parameter.
otherEnsure we have a snapshot while dropping ON COMMIT DROP temp tables (Tom Lane) This prevents possible misbehavior if any catalog entries for the temp tables have fields wide enough to require toasting (such as a very complex CHECK condition).
otherAvoid improper response to shutdown signals in child processes just forked by system() (Nathan Bossart) This fix avoids a race condition in which a child process that has been forked off by system(), but hasn't yet exec'd the intended child program, might receive and act on a signal intended for…
featureAvoid integer overflow when computing size of backend activity string array (Jakub Wartak) On 64-bit machines we will allow values of track_activity_query_size large enough to cause 32-bit overflow when multiplied by the allowed number of connections. The code actually allocating the per-backend…
fixFix briefly showing inconsistent progress statistics for ANALYZE on inherited tables (Heikki Linnakangas) The block-level counters should be reset to zero at the same time we update the current-relation field.
fixFix the background writer to report any WAL writes it makes to the statistics counters (Nazir Bilal Yavuz)
fixFix error-handling bug in RECORD type cache management (Thomas Munro) An out-of-memory error occurring at just the wrong point could leave behind inconsistent state that would lead to an infinite loop.
fixFix assertion failure when logical decoding is retried in the same session after an error (Hou Zhijie)
fixFix possible recovery failure due to trying to allocate memory based on a bogus WAL record length field (Thomas Munro, Michael Paquier)
fixFix datatype size confusion in logical tape management (Ranier Vilela) Integer overflow was possible on platforms where long is wider than int, although it would take a multiple-terabyte temporary file to cause a problem.
fixFix “could not duplicate handle” error occurring on Windows when min_dynamic_shared_memory is set above zero (Thomas Munro)
fixFix order of operations in GenericXLogFinish (Jeff Davis) This code violated the conditions required for crash safety by writing WAL before marking changed buffers dirty. No core code uses this function, but extensions do (contrib/bloom does, for example).
breakingRemove incorrect assertion in PL/Python exception handling (Alexander Lakhin)
fixFix pg_restore so that selective restores will include both table-level and column-level ACLs for selected tables (Euler Taveira, Tom Lane) Formerly, only the table-level ACL would get restored if both types were present.
breakingAdd logic to pg_upgrade to check for use of abstime, reltime, and tinterval data types (Álvaro Herrera) These obsolete data types were removed in PostgreSQL version 12, so check to make sure they aren't present in an older database before claiming it can be upgraded.
fixFix failure of contrib/btree_gin indexes on interval columns, when an indexscan using the < or <= operator is performed (Dean Rasheed) Such an indexscan failed to return all the entries it should.
featureAdd support for LLVM 16 and 17 (Thomas Munro, Dmitry Dolgov)
breakingRemove PHOT (Phoenix Islands Time) from the default timezone abbreviations list (Tom Lane) Presence of this abbreviation in the default list can cause failures on recent Debian and Ubuntu releases, as they no longer install the underlying tzdb entry by default. Since this is a made-up abbreviation…
+16 more items in the release notessecurityDisallow substituting a schema or owner name into an extension script if the name contains a quote, backslash, or dollar sign (Noah Misch) This restriction guards against SQL-injection hazards for trusted extensions. The PostgreSQL Project thanks Micah Gates, Valerie Woolard, Tim Carey-Smith, and…
fixFix confusion between empty (no rows) ranges and all-NULL ranges in BRIN indexes, as well as incorrect merging of all-NULL summaries (Tomas Vondra) Each of these oversights could result in forgetting that a BRIN index range contains any NULL values, potentially allowing subsequent queries that…
breakingAvoid leaving a corrupted database behind when DROP DATABASE is interrupted (Andres Freund) If DROP DATABASE was interrupted after it had already begun taking irreversible steps, the target database remained accessible (because the removal of its pg_database row would roll back), but it would have…
featureEnsure that partitioned indexes are correctly marked as valid or not at creation (Michael Paquier) If a new partitioned index matches an existing but invalid index on one of the partitions, the partitioned index could end up being marked valid prematurely. This could lead to misbehavior or…
featureIgnore invalid child indexes when matching partitioned indexes to child indexes during ALTER TABLE ATTACH PARTITION (Michael Paquier) Such an index will now be ignored, and a new child index created instead.
fixFix possible failure when marking a partitioned index valid after all of its partitions have been attached (Michael Paquier) The update of the index's pg_index entry could use stale data for other columns. One reported symptom is an “attempted to update invisible tuple” error.
fixFix ALTER EXTENSION SET SCHEMA to complain if the extension contains any objects outside the extension's schema (Michael Paquier, Heikki Linnakangas) Erroring out if the extension contains objects in multiple schemas was always intended; but the check was mis-coded so that it would fail to detect…
otherDon't use partial unique indexes for uniqueness proofs in the planner (David Rowley) This could give rise to incorrect plans, since the presumed uniqueness of rows read from a table might not hold if the index in question isn't used to scan the table.
otherDon't Memoize lateral joins with volatile join conditions (Richard Guo) Applying Memoize to a sub-plan that contains volatile filter conditions is likely to lead to wrong answers. The check to avoid doing this missed some cases that can arise when using LATERAL.
breakingAvoid producing incorrect plans for foreign joins with pseudoconstant join clauses (Etsuro Fujita) The planner currently lacks support for attaching pseudoconstant join clauses to a pushed-down remote join, so disable generation of remote joins in such cases. (A better solution will require…
securityCorrectly handle sub-SELECTs in RLS policy expressions and security-barrier views when expanding rule actions (Tom Lane)
fixFix race conditions in conflict detection for SERIALIZABLE isolation mode (Thomas Munro) Conflicts could be missed when using bitmap heap scans, when using GIN indexes, and when examining an initially-empty btree index. All these cases could lead to serializability failures due to improperly…
fixFix misbehavior of EvalPlanQual checks with inherited or partitioned target tables (Tom Lane) This oversight could lead to update or delete actions in READ COMMITTED isolation mode getting performed when they should have been skipped because of a conflicting concurrent update.
fixFix hash join with an inner-side hash key that contains Params coming from an outer nested loop (Tom Lane) When rescanning the join after the values of such Params have changed, we must rebuild the hash table, but neglected to do so. This could result in missing join output rows.
fixFix intermittent failures when trying to update a field of a composite column (Tom Lane) If the overall value of the composite column is wide enough to require out-of-line toasting, then an unluckily-timed cache flush could cause errors or server crashes.
otherPrevent query-lifespan memory leaks in some UPDATE queries with triggers (Tomas Vondra)
otherPrevent query-lifespan memory leaks when an Incremental Sort plan node is rescanned (James Coleman, Laurenz Albe, Tom Lane)
otherAccept fractional seconds in the input to jsonpath's datetime() method (Tom Lane)
fixPrevent stack-overflow crashes with very complex text search patterns (Tom Lane)
featureAllow tokens up to 10240 bytes long in pg_hba.conf and pg_ident.conf (Tom Lane) The previous limit of 256 bytes has been found insufficient for some use-cases.
fixFix mishandling of C++ out-of-memory conditions (Heikki Linnakangas) If JIT is in use, running out of memory in a C++ new call would lead to a PostgreSQL FATAL error, instead of the expected C++ exception.
fixFix rare null-pointer crash in plancache.c (Tom Lane)
featureAvoid losing track of possibly-useful shared memory segments when a page free results in coalescing ranges of free space (Dongming Liu) Ensure that the segment is moved into the appropriate “bin” for its new amount of free space, so that it will be found by subsequent searches.
fixAllow VACUUM to continue after detecting certain types of b-tree index corruption (Peter Geoghegan) If an invalid sibling-page link is detected, log the issue and press on, rather than throwing an error as before. Nothing short of REINDEX will fix the broken index, but preventing VACUUM from…
otherEnsure that WrapLimitsVacuumLock is released after VACUUM detects invalid data in pg_database.datfrozenxid or pg_database.datminmxid (Andres Freund) Failure to release this lock could lead to a deadlock later, although the lock would be cleaned up if the session exits or encounters some other error.
fixAvoid double replay of prepared transactions during crash recovery (suyu.cmj, Michael Paquier) After a crash partway through a checkpoint with some two-phase transaction state data already flushed to disk by this checkpoint, crash recovery could attempt to replay the prepared transaction(s) twice,…
fixFix possible failure while promoting a standby server, if archiving is enabled and two-phase transactions need to be recovered (Julian Markwort) If any required two-phase transactions were logged in the most recent (partial) log segment, promotion would fail with an incorrect complaint about…
fixEnsure that a newly created, but still empty table is fsync'ed at the next checkpoint (Heikki Linnakangas) Without this, if there is an operating system crash causing the empty file to disappear, subsequent operations on the table might fail with “could not open file” errors.
fixEnsure that creation of the init fork of an unlogged index is WAL-logged (Heikki Linnakangas) While an unlogged index's main data fork is not WAL-logged, its init fork should be, to ensure that we have a consistent state to restore the index to after a crash. This step was missed if the init fork…
fixFix missing reinitializations of delay-checkpoint-end flags (suyu.cmj) This could result in unnecessary delays of checkpoints, or in assertion failures in assert-enabled builds.
fixFix overly strict assertion in jsonpath code (David Rowley) This assertion failed if a query applied the .type() operator to a like_regex result. There was no bug in non-assert builds.
otherAvoid assertion failure when processing an empty statement via the extended query protocol in an already-aborted transaction (Tom Lane)
fixFix contrib/fuzzystrmatch's Soundex difference() function to handle empty input sanely (Alexander Lakhin, Tom Lane) An input string containing no alphabetic characters resulted in unpredictable output.
otherTighten whitespace checks in contrib/hstore input (Evan Jones) In some cases, characters would be falsely recognized as whitespace and hence discarded.
fixDisallow oversize input arrays with contrib/intarray's gist__int_ops index opclass (Ankit Kumar Pandey, Alexander Lakhin) Previously this code would report a NOTICE but press on anyway, creating an invalid index entry that presents a risk of crashes when the index is read.
otherAvoid useless double decompression of GiST index entries in contrib/intarray (Konstantin Knizhnik, Matthias van de Meent, Tom Lane)
fixFix contrib/pageinspect's gist_page_items() function to work when there are included index columns (Alexander Lakhin, Michael Paquier) Previously, if the index has included columns, gist_page_items() would fail to display those values on index leaf pages, or crash outright on non-leaf pages.
fixFix pg_dump to correctly handle new-style SQL-language functions whose bodies require parse-time dependencies on unique indexes (Tom Lane) Such cases can arise from GROUP BY and ON CONFLICT clauses, for example. The function must then be postponed until after the unique index in the dump output,…
fixEnsure that pg_index.indisreplident is kept up-to-date in relation cache entries (Shruthi Gowda) This value could be stale in some cases. There is no core code that relies on the relation cache's copy, so this is only a latent bug as far as Postgres itself is concerned; but there may be extensions…