# PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE

Source: [The Hacker News](https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html) · 2026-11-13 · Security
Page: https://themorning.dev/story/postgresql-patches-52-flaws-including-22-year-old-bug-enabling-authenticated-rce-e05f7a78ce38d83c
Kind: security · Impact: high

## In brief

- PostgreSQL released updates on 2026-11-12 that fix 52 security flaws.
- A 22-year-old type confusion flaw lets a database user who can create objects run code on the server.
- Full protection from the type confusion flaw also requires rebuilding any C-language extensions installed on the server.
- Planet PostgreSQL reports that Debian and Red Hat packages of Postgres 18.7 were also handled to protect users.

## Why it matters

If untrusted or low-privilege users can create objects on your PostgreSQL server, they may be able to run code on it. Updating alone is not enough when C-language extensions are installed, because they must be rebuilt too.

## What to do

- Upgrade PostgreSQL to the released update, 18.7 for the 18 branch
- Rebuild any C-language extensions installed on the server

## Versions

- PostgreSQL 18.7

## Timeline

- 2026-11-12: PostgreSQL updates released fixing 52 security flaws, including the type confusion bug

## Coverage

- [PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE](https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html) — The Hacker News, 2026-11-13
- [Jeremy Schneider: Postgres 18.7 Debian and Redhat Packagers Protect You](https://postgr.es/p/9BN) — Planet PostgreSQL, 2026-11-13

Tags: postgresql, security, vulnerability, rce, patch, database

---

Brief generated by AI (claude-haiku-5-5) from the reporting listed under Coverage. Headlines belong to their publishers. The Morning Dev – https://themorning.dev