NES for PostgreSQL 14 Release Notes

Release notes for NES for PostgreSQL 14. Each release lists the upstream PostgreSQL version, the bundled component versions, and the security fixes applied in that release.

14.24

• Based on upstream PostgreSQL 14.24.
• Bundled OpenSSL 3.5.7 with the OpenSSL 3.1.2 FIPS provider (CMVP cert #4985).
• Available in standard and minimal builds across Linux, AIX, Solaris, and Windows.
• Security fixes in the PostgreSQL server:
  • CVE-2026-6471 Logical decoding allowed a replication user to load any library as an output plugin, enabling exploits of various sorts; plugins are now restricted to the set named by the new output_plugin_libraries server parameter.
  • CVE-2026-16239 EXECUTE and FETCH run through two portals whose declared row types could be made to disagree, corrupting the returned data; the output row type is now cross-checked between them.
  • CVE-2026-14669 A buffer overrun in to_char() with a long time zone abbreviation could crash the server, with reported exploits reaching arbitrary code execution.
  • CVE-2026-14664 The regexp match and split functions could write past the end of their conversion buffer when passed invalidly-encoded data.
  • CVE-2026-18024 The ascii() function could be coaxed with invalidly-encoded input into reading and returning bytes it should not.
  • CVE-2026-16238 pg_restore_attribute_stats() treated multirange types like their underlying range type, which was wrong for every statistics kind except the bounds histogram.
  • CVE-2026-14668 The scalarineqsel() selectivity estimator trusted that its constant was of type tid; a maliciously-constructed operator could violate that, leading to a crash or server memory disclosure. The type is now checked.
  • CVE-2026-14662 The documented length limits on tsvector and tsquery values (individual lexemes and total size) were not enforced on every code path; they are now.
  • CVE-2026-14679 Several places assumed no more than FUNC_MAX_ARGS function arguments; notably the parser failed to enforce the aggregate-function limit of FUNC_MAX_ARGS - 1.
  • CVE-2026-14680 Calls from SQL to functions taking or returning type internal are now rejected with explicit checks, the prior defenses having been shown insufficient.
  • CVE-2026-6469 Extended statistics objects rebuilt by ALTER TABLE changed ownership to the role running the command; ownership is now preserved.
  • CVE-2026-6470 CREATE TYPE AS RANGE, ALTER TABLE OF, and commands creating stored expressions did not check USAGE privilege on the data types involved, letting roles without that privilege use them anyway.
  • CVE-2026-14666 Cached plans were not invalidated after role membership, role attribute, or database ownership changes, so row-level security could keep applying a stale policy decision.
  • CVE-2026-14681 After a direct TLS connection was established, the server still accepted a GSSEncRequest, producing a connection that used TLS but matched pg_hba.conf as a GSS connection; the request is now rejected.
  • CVE-2026-14672 The mock SCRAM secrets generated for nonexistent roles were distinguishable from real ones, weakening the defense against user enumeration; they are now more plausible.
  • CVE-2026-15741 EXTRACT() field names were deparsed without quoting, so a stored call with a crafted field name could inject SQL into dump output; field names are now quoted when needed.
• Security fixes in the client tools (psql, pg_dump, ecpg):
  • CVE-2026-6464 When a scripted COPY ... FROM STDIN failed at startup, psql executed the in-line data that followed as SQL commands; that data is now skipped.
  • CVE-2026-18408 psql applied backquote expansion to the argument of \unrestrict, letting a malicious server inject shell commands into plain-text dump output that run at restore time — the exact scenario CVE-2025-8714 was meant to prevent.
  • CVE-2026-16241 ecpg assumed a bytea value from the server begins with \x; a broken or malicious server sending a shorter string caused out-of-bounds writes in client applications.
  • CVE-2026-19385 pg_dump assumed pg_proc.protrftypes cannot exceed FUNC_MAX_ARGS entries, which a crafted catalog could violate.
• Security fixes in the procedural languages:
  • CVE-2026-14670 PL/Perl is hardened against tied Perl arrays and hashes, which could cause memory overwrite or a corrupt result array.
  • CVE-2026-14677 Integer overflows in memory-allocation calculations in PL/Perl and PL/Tcl (the same class of problem as CVE-2026-6473, in a different part of the code).
• Security fixes in contrib modules:
  • CVE-2026-14663 pgcrypto's PGP encryption did not notice when OpenSSL rejected the requested cipher (for example in FIPS mode), and silently produced output that was not encrypted with that cipher; unsupported ciphers are now detected and reported.
  • CVE-2026-14673 amcheck functions now restrict search_path before executing index expressions, closing a path for a caller to run arbitrary code as the table owner.
  • CVE-2026-15742 Integer overflows in fuzzystrmatch's levenshtein() functions with large cost values produced nonsensical results and could cause out-of-bounds writes.
  • CVE-2026-14676 pg_stat_statements query normalization under-counted the space the normalized string requires, causing a buffer overrun.
  • CVE-2026-14678 A datatype error in pg_trgm's GiST picksplit function read past the end of a buffer, typically causing bad split decisions and occasionally a crash.
  • CVE-2026-14671 refint's plan cache is removed: check_foreign_key() embedded the originally-seen key values in cached cascade-UPDATE queries, so reused plans updated the wrong rows.

14.23

• Based on upstream PostgreSQL 14.23.
• Bundled OpenSSL 3.5.7 with the OpenSSL 3.1.2 FIPS provider (CMVP cert #4985).
• Available in standard and minimal builds across Linux, AIX, Solaris, and Windows.