postgresql-18.2

[Bruce Dubbs]

New minor version.

[Douglas R. Reno]

Release notes:

Bug Fixes and Improvements

This update fixes over 65 bugs that were reported in the last several months. The issues 
listed below affect PostgreSQL 18. Some of these issues may also affect other supported 
versions of PostgreSQL.

Fix inconsistent case-insensitive text matching in the ltree extension. If you use an 
index on an ltree column, in some cases you may need perform a reindex. See the 
"Updating" section for additional instructions.

Executing ALTER TABLE ... ADD CONSTRAINT to add a NOT NULL constraint on a column that 
already is marked as NOT NULL now requires the constraint name to match the existing 
constraint name.

Fix trigger behavior when MERGE is executed from a WITH query to include rows affected 
by the MERGE.
Several query planner fixes.

Fix for text substring search for non-deterministic collations.

Several fixes for NOTIFY error handling and reporting.

Use the correct ordering function in GIN index parallel builds.

Fix incorrect handling of incremental backups with tables larger than 1GB.

Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint 
record.

Fix for ALTER PUBLICATION to ensure event triggers contain all set options.

Several fixes around replication slot initialization.

Don't advance replication slot after a logical replication parallel worker apply failure 
to prevent transaction loss on the subscriber.

Fix error reporting for SQL/JSON path type mismatches.

Fix JIT compilation function inlining when using LLVM 17 or later.

Add new server parameter file_extend_method to control use of posix_fallocate().

Fix psql tab completion for the VACUUM command options.

Fix pg_dump to handle concurrent sequence drops gracefully and to fail if the calling 
user explicitly lacks privileges to read the sequence.

Several fixes for amcheck around btree inspection.

Avoid crash in pg_stat_statements when an IN list contains both constants and non-
constant expressions.

In addition to this though, there are several security fixes:

CVE-2026-2003

CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory

CVSS v3.1 Base Score: 4.3

Supported, Vulnerable Versions: 14 - 18.

Improper validation of type oidvector in PostgreSQL allows a database user to disclose a 
few bytes of server memory. We have not ruled out viability of attacks that arrange for 
presence of confidential information in disclosed bytes, but they seem unlikely. 
Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

CVE-2026-2004

CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity 
estimator executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of type of input in PostgreSQL intarray extension selectivity 
estimator function allows an object creator to execute arbitrary code as the operating 
system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, 
and 14.21 are affected.

CVE-2026-2005

CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute 
arbitrary code as the operating system user running the database. Versions before 
PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

CVE-2026-2006

CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes 
arbitrary code

CVSS v3.1 Base Score: 8.8

Supported, Vulnerable Versions: 14 - 18.

Missing validation of multibyte character length in PostgreSQL text manipulation allows 
a database user to issue crafted queries that achieve a buffer overrun. That suffices to 
execute arbitrary code as the operating system user running the database. Versions 
before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

CVE-2026-2007

CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

CVSS v3.1 Base Score: 8.2

Supported, Vulnerable Versions: 18.

Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown 
impacts via a crafted input string. The attacker has limited control over the byte 
patterns to be written, but we have not ruled out the viability of attacks that lead to 
privilege escalation. PostgreSQL 18.1 and 18.0 are affected.

[Douglas R. Reno]

Fixed at 63d5e7c431bf99e415162221fc5f5d087ef8a6f4

SA-12.4-093 issued