Security · High impactFan score 43 · Tier B2 sources
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE
The Hacker News ·
The Brief · written from 2 sources
- PostgreSQL released updates on 2026-11-12 that fix 52 security flaws.
- A 22-year-old type confusion flaw lets a database user who can create objects run code on the server.
- Full protection from the type confusion flaw also requires rebuilding any C-language extensions installed on the server.
- Planet PostgreSQL reports that Debian and Red Hat packages of Postgres 18.7 were also handled to protect users.
Why it matters
If untrusted or low-privilege users can create objects on your PostgreSQL server, they may be able to run code on it. Updating alone is not enough when C-language extensions are installed, because they must be rebuilt too.
Who’s affected
- Teams running PostgreSQL servers
- Operators of PostgreSQL with C-language extensions installed
- Debian and Red Hat users of PostgreSQL packages
What to do
- Upgrade PostgreSQL to the released update, 18.7 for the 18 branch
- Rebuild any C-language extensions installed on the server
- PostgreSQL 18.7
- #postgresql
- #security
- #vulnerability
- #rce
- #patch
- #database
A type confusion flaw in PostgreSQL lets a database user who can create objects run code on the server. Updates released yesterday fix it, along with 51 other security flaws. Full protection from this flaw also requires rebuilding any C-language extensions installed on the…
Timeline
PostgreSQL updates released fixing 52 security flaws, including the type confusion bug
Planet PostgreSQL
Jeremy Schneider: Postgres 18.7 Debian and Redhat Packagers Protect You
The Hacker News
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE