PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
PostgreSQL fixes 52 flaws, including CVE-2026-6460 (CVSS 8.8), a 22-year-old type confusion bug that lets authenticated users run code. Patch now.
What’s new: PostgreSQL has released updates fixing 52 security vulnerabilities. The most serious is CVE-2026-6460 (CVSS 8.8), a type confusion flaw in composite types that can let an authenticated user execute code on the server with the privileges of the PostgreSQL operating-system user. The root cause dates back to May 2004.
How the bug works
A field’s type in a composite type can be changed while older values of that type still exist elsewhere in the server. The server can then read an old value as if it had the new type, which opens the door to memory corruption.
Who’s affected
All supported PostgreSQL branches before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected, especially deployments that let users create or modify objects. No exploitation in the wild has been reported. A public write-up demonstrates a crash and a memory-address leak but withholds the final code-execution step.
What to do
- Upgrade to 18.7, 17.12, 16.16, 15.20 or 14.25 (matching your major version).
- Rebuild or update all C-language extensions at the same time as the server.
- Restart PostgreSQL if it runs outside its package’s service unit.
- Update client tools such as pg_dump, pg_restore, reindexdb and vacuumdb on every machine.
- Do not use the new composite_type_mismatch setting to disable the checks.
- Follow the reindexing steps in the release announcement after updating.
- If you use incremental backups, take a new full backup and base later increments on it.
