PostgreSQL released updates fixing 52 security issues, notably addressing a 22-year-old type confusion flaw tracked as CVE-2026-6460.
The updates impact versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
Full mitigation requires server updates, rebuilding C extensions, and updating client utilities.
How the problem works
The vulnerability concerns the way the server handles complex data types, where a field type could change while older values were still stored. Security researchers were able to show how the issue could cause the server to crash or read portions of its memory. According to available evidence, no real attacks have been recorded so far that exploit this issue.
Researchers had notified major cloud service providers that offer databases, such as Amazon, Microsoft, Google and others, since August. The issue affects all older versions before 18.7, 17.12, 16.16, 15.20 and 14.25. It is noted that the 14 series has now completed its lifecycle and version 14.25 is the last one released for it.
What should administrators do?
In addition to the core server, the update also includes fixes for tools used for backup and management. To fully protect systems, administrators are advised to update the software, rebuild or update all C-based add-ons installed on the server, refresh indexes, and take new backups.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)