PostgreSQL shipped 18.7 on November 12, fixing 52 CVEs in a single release — the largest security patch batch in the project’s history. The headline flaw, CVE-2026-6460, is a type confusion vulnerability that has been in the codebase since 2004. Any authenticated user with CREATE privileges can execute arbitrary code as the OS user running your database. A working proof of concept already exists. And if you’re running Ubuntu’s apt repositories or AWS RDS, there’s a real chance you’re not patched yet even if you already ran your upgrade commands.
The 22-Year-Old Bug
CVE-2026-6460 is a type confusion flaw in how PostgreSQL handles composite typed values after a DDL operation changes a column’s type. The underlying primitive entered the codebase on May 5, 2004 — the same era that brought ALTER TABLE support to PostgreSQL. For 22 years, it survived code review, security audits, and dozens of minor releases.
The attack shape is simple once you see it. Prepare a query plan against a composite column. Use ALTER TABLE ... SET DATA TYPE to change that column underneath the plan. Execute the plan. The server reads the old bytes as the new type — values are not self-identifying and the system does not track stale cached representations. From there: crash, memory address leak, then code execution. Security researcher Mehmet Ince published a full technical writeup demonstrating the chain on PostgreSQL 18.6, including a video — he withheld the final payload but published the crash SQL and address leak.
CVSS score: 8.8. Required privileges: CREATE, not superuser. No in-the-wild exploitation has been confirmed yet, but the window between a public PoC and active exploitation is typically measured in days.
You Might Not Be Patched Yet
This is the part that matters most. Running sudo apt upgrade and seeing “nothing to upgrade” does not mean you are protected. As of November 13, Ubuntu’s apt archive was still serving postgresql-16 at version 16.15 — not 16.16. The patched builds had not propagated to Ubuntu’s default repositories. The PostgreSQL apt.postgresql.org repository had the correct versions; Ubuntu’s default archive did not.
AWS RDS was still listing 18.6 as the newest available version the day after the release. Azure, GCP, Supabase, and other managed providers were privately notified in August but apply patches on their own maintenance schedules. If you are on a managed service, check your provider’s console for a pending maintenance window rather than assuming the November 12 release date covers you.
Docker users are the exception — postgres:18.7, 17.12, and 16.16 were updated immediately and are safe to pull now.
apt upgrade Alone Is Not Enough
Even once the patched builds hit your package manager, a standard server upgrade is not sufficient for full protection. The fix converts DatumGetHeapTupleHeader() from a macro into a server function and adds a new check inside heap_getattr(). Any C-language extension compiled against the old headers will not pick up those checks.
That means every C extension on your server — pgvector, PostGIS, pg_cron, TimescaleDB, pg_partman — needs to be rebuilt or upgraded alongside the server. On dnf systems, a rebuilt extension will now declare a minimum requirement of postgresql18-libs >= 18.7, so the package manager will refuse to install a new extension next to an unpatched server. If you run PostgreSQL under Patroni or another orchestrator, restart it explicitly after updating rather than relying on the service unit.
The Rest of the 52
CVE-2026-6460 is the headline, but 51 other CVEs shipped alongside it. Thirty-two of them score CVSS 8.8. They cover PL/Perl, PL/Tcl, the ts_rank_cd() text search function, parallel query, logical replication, dblink, and statistics import — most involve memory errors allowing an authenticated user to execute code as the postgres OS user. Six CVEs require only a login, with no additional privileges needed.
Notable additions: CVE-2026-116304 fixes a race condition leading to use-after-free in shared tuple descriptor management; CVE-2026-116314 hardens pg_restore against corrupt archives to close a path traversal hazard. The full list is in the official 18.7 release notes.
Patch Now
The target versions are 18.7, 17.12, 16.16, 15.20, and 14.25. PostgreSQL 14 reached end of life with this release and will receive no further security patches. If you’re still on PG14, upgrade to a supported branch — PostgreSQL 19 ships November 19.
# Ubuntu/Debian (use apt.postgresql.org repo for immediate availability)
sudo apt install --only-upgrade postgresql-18 postgresql-client-18
# RHEL/Rocky/AlmaLinux
sudo dnf upgrade -y "postgresql18*"
# Docker — pull the updated image
docker pull postgres:18.7
docker pull postgres:17.12
docker pull postgres:16.16Verify your version after upgrading:
SELECT version();
-- Should return: PostgreSQL 18.7 (or 17.12 / 16.16 / 15.20 / 14.25)Then rebuild your C extensions. That step is not optional.
