PostgreSQL: A Security Patch Batch Lands
Today's activity is dominated by a coordinated set of security fixes covering privilege checks, psql input handling, pgcrypto encryption bugs, and logical replication plugin trust — five separate CVEs addressed in a single batch, all backpatched to version 14.
Duration: PT2M37S
Episode overview
This episode is a short developer briefing from PostgreSQL.
It explains recent repository work in plain language.
- Show: PostgreSQL
- Published: 2026-08-11T13:05:03Z
- Audio duration: PT2M37S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good morning. It's August 11th, 2026, and today's PostgreSQL commit history reads less like routine development and more like a coordinated security release.
The headline pattern: five distinct CVEs got fixed today, and nearly every commit traces back to one of them. Start with privilege checks. Nathan Bossart closed two related gaps — one where roles without USAGE privilege on a type could still create stored expressions depending on it, in commit 4fac4c1, and a nearly…
Next, psql's handling of untrusted input. Tom Lane fixed a case where a failed COPY FROM STDIN command left psql confused about whether inline data was still coming — meaning that data could get executed as SQL instead of being skipped. That's a real SQL-injection risk, tracked as CVE-2026-6464 in commit 3045a25. A…
Third theme: trust boundaries for plugins and ciphers. Jacob Champion introduced a new setting, output plugin libraries, so database administrators can explicitly whitelist which logical decoding plugins are trusted — closing a gap where replication users could load arbitrary plugins outside normal LOAD…
And in pgcrypto, Daniel Gustafsson and Jacob Champion fixed a case where PGP encryption silently…
What's…
Nearby episodes from PostgreSQL
- Cleanup, Correctness, and Retiring Old Interfaces
- Closing the Gaps Between Related Commands
- Correctness Fixes Across Replication, Stats, and Tooling
- Tightening Up Input Handling and Storage Defaults
- Correctness and Crypto Cleanup
- Weekly Recap - Correctness Fixes Under Concurrency and Crash Recovery
- Two Backpatched Fixes for v18
- Referential Integrity Fast-Path Hardening