PostgreSQL 15.14 → 15.17
3 releases · 2 breaking changes · 9 security fixes · 4 advisories fixed
9security2breaking0deprecated12feature51fix
Vulnerabilities fixed by this upgrade
- 4.3 CVE-2026-2003 Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confi…
- 8.8 CVE-2026-2004 Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the datab…
- 8.8 CVE-2026-2005 Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12,…
- 8.8 CVE-2026-2006 Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary c…
Breaking changes
- breaking Remove faulty assertion in btree index cleanup (Peter Geoghegan) in 15.15
- breaking Remove the unfinished slot state file after failing to write a replication slot's state to disk (Michael Paquier) Previously, a failure such as out-of-disk-space resulted in leaving a temporary state.tmp file behind. That's problematic because it would block all subsequent attempts to write the… in 15.15
Security changes
- security Avoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data (Noah Misch) The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid. in 15.17
- security Guard against unexpected dimensions of oidvector/int2vector (Tom Lane) These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without… in 15.16
- security Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type.… in 15.16
- security Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for… in 15.16
- security Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for… in 15.16
- security Check for CREATE privileges on the schema in CREATE STATISTICS (Jelte Fennema-Nio) This omission allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts. The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2025-12817) in 15.15
- security Avoid integer overflow in allocation-size calculations within libpq (Jacob Champion) Several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which… in 15.15
- security In pg_dump, dump security labels on subscriptions and event triggers (Jian He, Fujii Masao) Labels on these types of objects were previously missed. in 15.15
- security In pg_restore, skip comments and security labels for publications and subscriptions that are not being restored (Jian He, Fujii Masao) Do not emit COMMENT or SECURITY LABEL commands for these objects when --no-publications or --no-subscriptions is specified. in 15.15
Every release in between
fixFix failure after replaying a multixid truncation record from WAL that was generated by an older minor version (Heikki Linnakangas) Erroneous logic for coping with the way that previous versions handled multixid wraparound led to replay failure, with messages like “could not access status of…
securityAvoid incorrect complaint of invalid encoding when substring() is applied to “toasted” data (Noah Misch) The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.
fixFix pg_stat_get_backend_wait_event() and pg_stat_get_backend_wait_event_type() to report values for auxiliary processes (Heikki Linnakangas) Previously these functions returned NULL for auxiliary processes, but that's inconsistent with the pg_stat_activity view.
fixFix casting a composite-type variable to a domain type when returning its value from a PL/pgSQL function (Tom Lane) If the variable's value is NULL, a “cache lookup failed for type 0” error resulted.
fixFix potential null pointer dereference in contrib/hstore's binary input function (Michael Paquier) hstore's receive function crashed on input containing duplicate keys. hstore values generated by Postgres would never contain duplicate keys, so this mistake has gone unnoticed. The crash could be…
securityGuard against unexpected dimensions of oidvector/int2vector (Tom Lane) These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without…
securityHarden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type.…
securityFix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution. The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for…
securityFix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for…
featureDon't allow CTE references in sub-selects to determine semantic levels of aggregate functions (Tom Lane) This change undoes a change made two minor releases ago, instead throwing an error if a sub-select references a CTE that's below the semantic level that standard SQL rules would assign to the…
fixFix trigger transition table capture for MERGE in CTE queries (Dean Rasheed) When executing a data-modifying CTE query containing both a MERGE and another DML operation on a table with statement-level AFTER triggers, the transition tables passed to the triggers would not include the rows affected…
fixFix failure when all children of a partitioned target table of an update or delete have been pruned (Amit Langote) In such cases, the executor could report “could not find junk ctid column” errors, even though nothing needs to be done.
featureAllow indexscans on partial hash indexes even when the index's predicate implies the truth of the WHERE clause (Tom Lane) Normally we drop a WHERE clause that is implied by the predicate, since it's pointless to test it; it must hold for every index entry. However that can prevent creation of an…
fixDo not emit WAL for unlogged BRIN indexes (Kirill Reshke) One seldom-taken code path incorrectly emitted a WAL record relating to a BRIN index even if the index was marked unlogged. Crash recovery would then fail to replay that record, complaining that the file already exists.
otherPrevent truncation of CLOG that is still needed by unread NOTIFY messages (Joel Jacobson, Heikki Linnakangas) This fix prevents “could not access status of transaction” errors when a backend is slow to absorb NOTIFY messages.
featureEscalate errors occurring during NOTIFY message processing to FATAL, i.e. close the connection (Heikki Linnakangas) Formerly, if a backend got an error while absorbing a NOTIFY message, it would advance past that message, report the error to the client, and move on. That behavior was fraught with…
fixFix bug in following update chain when locking a tuple (Jasper Smit) This code path neglected to check the xmin of the first new tuple in the update chain, making it possible to lock an unrelated tuple if the original updater aborted and the space was immediately reclaimed by VACUUM and then…
fixFix issues around in-place catalog updates (Noah Misch) Send a nontransactional invalidation message for an in-place update, since such an update will survive transaction rollback. Also ensure that the update is WAL-logged before other sessions can see it. These fixes primarily prevent scenarios…
fixFix potential backend process crash at process exit due to trying to release a lock in an already-unmapped shared memory segment (Rahila Syed)
fixGuard against incorrect truncation of the multixact log after a crash (Heikki Linnakangas)
fixFix possibly mis-encoded result of pg_stat_get_backend_activity() (Chao Li) The shared-memory buffer holding a session's activity string can end with an incomplete multibyte character. Readers are supposed to truncate off any such incomplete character, but this function failed to do so.
otherGuard against recursive memory context logging (Fujii Masao) A constant flow of signals requesting memory context logging could cause recursive execution of the logging code, which in theory could lead to stack overflow.
fixFix memory context usage when reinitializing a parallel execution context (Jakub Wartak, Jeevan Chalke) This error could result in a crash due to a subsidiary data structure having a shorter lifespan than the parallel context. The problem is not known to be reachable using only core PostgreSQL,…
featureSet next multixid's offset when creating a new multixid, to remove the wait loop that was needed in corner cases (Andrey Borodin) The previous logic could get stuck waiting for an update that would never occur.
otherAvoid rewriting data-modifying CTEs more than once (Bernice Southey, Dean Rasheed) Formerly, when updating an auto-updatable view or a relation with rules, if the original query had any data-modifying CTEs, the rewriter would rewrite those CTEs multiple times due to recursion. This was inefficient…
fixFail recovery if WAL does not exist back to the redo point indicated by the checkpoint record (Nitin Jadhav) Add an explicit check for this before starting recovery, so that no harm is done and a useful error message is provided. Previously, recovery might crash or corrupt the database in this…
otherAvoid scribbling on the source query tree during ALTER PUBLICATION (Sunil S) This error had the visible effect that an event trigger fired for the query would see only the first publish option, even if several had been specified. If such a query were set up as a prepared statement, re-executions…
otherPass connection options specified in CREATE SUBSCRIPTION ... CONNECTION to the publisher's walsender (Fujii Masao) Before this fix, the options connection option (if any) was ignored, thus for example preventing setting custom server parameter values in the walsender session. It was intended for…
featurePrevent invalidation of newly created or newly synced replication slots (Zhijie Hou) A race condition with a concurrent checkpoint could allow WAL to be removed that is needed by the replication slot, causing the slot to immediately get marked invalid.
fixFix race condition in computing a replication slot's required xmin (Zhijie Hou) This could lead to the error “cannot build an initial slot snapshot as oldest safe xid follows snapshot's xmin”.
featureDuring initial synchronization of a logical replication subscription, commit the addition of a pg_replication_origin entry before starting to copy data (Zhijie Hou) Previously, if the copy step failed, the new pg_replication_origin entry would be lost due to transaction rollback. This led to…
fixFix possible failure with “unexpected data beyond EOF” during restart of a streaming replica server (Anthonin Bonnefoy)
fixFix erroneous tracking of column position when parsing partition range bounds (myzhen) This could, for example, lead to the wrong column name being cited in error messages about casting partition bound values to the column's data type.
fixFix assorted minor errors in error messages (Man Zeng, Tianchen Zhang) For example, an error report about mismatched timeline number in a backup manifest showed the starting timeline number where it meant to show the ending timeline number.
fixFix failure to perform function inlining when doing JIT compilation with LLVM version 17 or later (Anthonin Bonnefoy)
otherAdjust our JIT code to work with LLVM 21 (Holger Hoffstätte) The previous coding failed to compile on aarch64 machines.
otherSupport process title changes on GNU/Hurd (Michael Banck)
otherMake pg_resetwal print the updated value when changing OldestXID (Heikki Linnakangas) It already did that for every other variable it can change.
featureMake pg_resetwal allow setting next multixact xid to 0 or next multixact offset to UINT32_MAX (Maxim Orlov) These are valid values, so rejecting them was incorrect. In the worst case, if a pg_upgrade is attempted when exactly at the point of multixact wraparound, the upgrade would fail.
otherIn contrib/amcheck, use the correct snapshot for btree index parent checks (Mihail Nikalayeu) The previous coding caused spurious errors when examining indexes created with CREATE INDEX CONCURRENTLY.
fixFix contrib/amcheck to handle “half-dead” btree index pages correctly (Heikki Linnakangas) amcheck expected such a page to have a parent downlink, but it does not, leading to a false error report about “mismatch between parent key and child high key”.
fixFix contrib/amcheck to handle incomplete btree root page splits correctly (Heikki Linnakangas) amcheck could report a false error about “block is not true root”.
fixFix edge-case integer overflow in contrib/intarray's selectivity estimator for @@ (Chao Li) This could cause poor selectivity estimates to be produced for cases involving the maximum integer value.
fixFix multibyte-encoding issue in contrib/ltree (Jeff Davis) The previous coding could pass an incomplete multibyte character to lower(), probably resulting in incorrect behavior.
otherUpdate time zone data files to tzdata release 2025c (Tom Lane) The only change is in historical data for pre-1976 timestamps in Baja California.
securityCheck for CREATE privileges on the schema in CREATE STATISTICS (Jelte Fennema-Nio) This omission allowed table owners to create statistics in any schema, potentially leading to unexpected naming conflicts. The PostgreSQL Project thanks Jelte Fennema-Nio for reporting this problem. (CVE-2025-12817)
securityAvoid integer overflow in allocation-size calculations within libpq (Jacob Champion) Several places in libpq were not sufficiently careful about computing the required size of a memory allocation. Sufficiently large inputs could cause integer overflow, resulting in an undersized buffer, which…
fixFurther fix processing of character classes within SIMILAR TO regular expressions (Laurenz Albe) The previous fix for translating SIMILAR TO pattern matching expressions to POSIX-style regular expressions broke a corner case that formerly worked: if there is an escape character right after the…
fixFix parsing of aggregate functions whose arguments contain a sub-select with a FROM reference to a CTE outside the aggregate function (Tom Lane) Such a CTE reference must act like a outer-level column reference when determining the aggregate's semantic level; but it was not being accounted for,…
fixFix “no relation entry for relid” errors in corner cases while estimating SubPlan costs (Richard Guo)
otherAvoid unlikely use-after-free in planner's expansion of partitioned tables (Bernd Reiß) There was a hazard only when the last live partition was concurrently dropped.
breakingRemove faulty assertion in btree index cleanup (Peter Geoghegan)
fixFix possible infinite loop in GIN index scans with multiple scan conditions (Tom Lane) GIN can handle scan conditions that can reject non-matching entries but are not useful for searching for relevant entries, for example a tsquery clause like !term. But such a condition must not be first in the…
fixFix integer-overflow hazard in BRIN index scans when the table contains close to 232 pages (Sunil S) This oversight could result in an infinite loop or scanning of unneeded table pages.
fixFix incorrect zero-extension of stored values in JIT-generated tuple deforming code (David Rowley) When not using JIT, the equivalent code does sign-extension not zero-extension, leading to a different Datum representation of small integer data types. This inconsistency was masked in most cases,…
fixFix incorrect logic for caching result-relation information for triggers (David Rowley, Amit Langote) In cases where partitions' column sets aren't physically identical to their parent partitioned tables' column sets, this oversight could lead to crashes.
featureAdd missing EvalPlanQual rechecks for TID Scan and TID Range Scan plan nodes (Sophie Alpert, David Rowley) This omission led to possibly not rechecking a condition on ctid during concurrent-update situations, causing the update's behavior to vary depending on which plan type had been selected.
fixFix EvalPlanQual handling of foreign or custom joins that do not have an alternative local-join plan prepared for EPQ (Masahiko Sawada, Etsuro Fujita) In such cases the foreign or custom access method should be invoked normally, but that did not happen, typically leading to a crash.
featureAvoid duplicating hash partition constraints during DETACH CONCURRENTLY (Haiyang Li) ALTER TABLE DETACH PARTITION CONCURRENTLY was written to add a copy of the partitioning constraint to the now-detached partition. This was misguided, partially because non-concurrent DETACH doesn't do that, but…
fixFix visibility checking for statistics objects in pg_temp (Noah Misch) A statistics object located in a temporary schema cannot be named without schema qualification, but pg_statistics_obj_is_visible() missed that memo and could return “true” regardless. In turn, functions such as…
fixFix pg_event_trigger_dropped_objects()'s reporting of temporary status (Antoine Violin, Tom Lane) If a dropped column default, trigger, or RLS policy belongs to a temporary table, report it with is_temporary true.
fixFix memory leakage in hashed subplans (Haiyang Li) Any memory consumed by the hash functions used for hashing tuples constituted a query-lifespan memory leak. One way that could happen is if the values being hashed require de-toasting.
fixFix minor memory leak during WAL replay of database creation (Nathan Bossart)
fixFix corruption of the shared statistics table after out-of-memory failures (Mikhail Kot) Previously, an out-of-memory failure partway through creating a new hash table entry left a broken entry behind, potentially causing errors in other sessions later.
fixFix concurrent update issue in MERGE (Yugo Nagata) When executing a MERGE UPDATE action, if there is more than one concurrent update of the target row, the lock-and-retry code would sometimes incorrectly identify the latest version of the target tuple, leading to incorrect results.
featureAdd missing replica identity checks in MERGE and INSERT ... ON CONFLICT DO UPDATE (Zhijie Hou) If MERGE may require update or delete actions, and the target table publishes updates or deletes, insist that it have a REPLICA IDENTITY defined. Failing to require this can silently break replication.…
fixFix incorrect reporting of replication lag in pg_stat_replication view (Fujii Masao) If any standby server's replay LSN stopped advancing, the write_lag and flush_lag columns would eventually stop updating.
breakingRemove the unfinished slot state file after failing to write a replication slot's state to disk (Michael Paquier) Previously, a failure such as out-of-disk-space resulted in leaving a temporary state.tmp file behind. That's problematic because it would block all subsequent attempts to write the…
featureAvoid unwanted WAL receiver shutdown when switching from streaming to archive WAL source (Xuneng Zhou) During a timeline change, a standby server's WAL receiver should remain alive, waiting for a new WAL streaming start point. Instead it was repeatedly shutting down and immediately getting…
fixFix use-after-free issue in the relation synchronization cache maintained by the pgoutput logical decoding plugin (Vignesh C, Masahiko Sawada) An error during logical decoding could result in crashes in subsequent logical decoding attempts in the same session. The case is only reachable when…
fixFix incorrect printing of messages about failures in checking whether the user has Windows administrator privilege (Bryan Green) This code would have crashed or at least printed garbage. No such cases have been reported though, indicating that failure of these system calls is extremely rare.
fixFix false memory-context-checking warnings in debug builds on 64-bit Windows (David Rowley)
fixAvoid leaking memory when handling a SQL error within PL/Python (Tom Lane) This fixes a session-lifespan memory leak introduced in our previous minor releases.
fixFix libpq's trace output of characters with the high bit set (Ran Benita) On platforms where char is considered signed, the output included unsightly \xffffff decoration.
fixFix libpq's handling of socket-related errors on Windows within its GSSAPI logic (Ning Wu, Tom Lane) The code for encrypting/decrypting transmitted data using GSSAPI did not correctly recognize error conditions on the connection socket, since Windows reports those differently than other platforms.…
securityIn pg_dump, dump security labels on subscriptions and event triggers (Jian He, Fujii Masao) Labels on these types of objects were previously missed.
fixFix pg_dump's sorting of default ACLs and foreign key constraints (Kirill Reshke, Álvaro Herrera) Ensure consistent ordering of these database object types, as was already done for other object types.
securityIn pg_restore, skip comments and security labels for publications and subscriptions that are not being restored (Jian He, Fujii Masao) Do not emit COMMENT or SECURITY LABEL commands for these objects when --no-publications or --no-subscriptions is specified.
fixFix assorted errors in the data compression logic in pg_dump and pg_restore (Daniel Gustafsson, Tom Lane) Error checking was missing or incorrect in several places, and there were also portability issues that would manifest on big-endian hardware. These problems had been missed because this code…
fixFix pgbench to error out cleanly if a COPY operation is started (Anthonin Bonnefoy) pgbench doesn't intend to support this case, but previously it went into an infinite loop.
fixFix pgbench's reporting of multiple errors (Yugo Nagata) In cases where two successive PQgetResult calls both fail, pgbench might report the wrong error message.
fixFix contrib/pg_prewarm's privilege checks for indexes (Ayush Vatsa, Nathan Bossart) pg_prewarm() requires SELECT privilege on relations to be prewarmed. However, since indexes have no SQL privileges of their own, this resulted in non-superusers being unable to prewarm indexes. Instead, check for…
featureHarden our read and write barrier macros to satisfy Clang (Thomas Munro) We supposed that __atomic_thread_fence() is a sufficient barrier to prevent the C compiler from re-ordering memory accesses around it, but it appears that that's not true for Clang, allowing it to generate incorrect code for…
fixFix building with LLVM version 21 and later (Holger Hoffstätte)
fixFix PGXS build infrastructure to support building NLS po files for extensions (Ryo Matsumura)
+14 more items in the release notes