PostgreSQL Ships Critical Security Patches for All Supported Versions; PG 19 Beta 3 Arrives
PostgreSQL just shipped security patches for every supported version, and PG 19 Beta 3 landed at the same time. The maintenance releases cover 18.6, 17.11, 16.15, 15.19, and 14.24. The batch addresses 30 security vulnerabilities and more than 110 bug fixes. The highlight is a wave of heap buffer overflows that could let unauthenticated attackers run code on your database server.
The patch is notable for the concentration of critical-severity flaws. Seven CVEs score 8.8 on the CVSS v3.1 scale. Many involve integer wraparounds that create undersize memory allocations followed by out-of-bounds writes. Classic exploit primitives for remote code execution in server processes. The group flagged CVE-2026-14679 as a multi-issue flaw covering heap overflows in plperl and pg_stat_statements, plus type confusion in cursors. CVE-2026-14670 hits plperl tied objects. If you run PL/Perl, patching this one moves to the top of your priority list.
The release notes warn that "the most alarming pattern across this batch is the proliferation of heap buffer overflows and type confusion bugs triggered by low-privileged or unauthenticated attackers." That's a fair assessment. The integer wraparound vector is especially nasty because it turns standard parsing logic into an exploit primitive. You'll want to apply these updates before moving on to any feature testing.
PostgreSQL 19 Beta 3: What's Actually Changing
PostgreSQL 19 Beta 3 rounds out the release with a feature set that changes how you interact with the database. The standout is the REPACK command. It unifies VACUUM FULL and CLUSTER with a CONCURRENTLY option that rebuilds tables without blocking reads and writes. Production databases that used to need maintenance windows will get some breathing room. You also get SQL Property Graph Query syntax for native graph traversal, plus a FOR PORTION OF clause for temporal updates and deletes.
The beta includes more than just new syntax. Logical replication now syncs sequence values without a server restart. Autovacuum gains parallel worker support for index maintenance and a new scoring system that prioritizes tables based on configurable thresholds. Data checksums can now be toggled online instead of forcing an offline cluster stop. It's a solid preview of the upcoming stable release, though the feature list is already packed enough to keep you busy.
The optimizer changes in PG 19 are worth noting too. NOT IN clauses now convert to efficient ANTI JOINs when NULLs are absent. Aggregate processing moves before joins to reduce row counts early. The default TOAST compression switched from pglz to LZ4, which packs data more efficiently. If you run heavy analytical workloads, the JIT engine remains disabled by default because the costing model is still unreliable. You have to manually turn it on.
Post-Update Steps You Can't Skip
There are a few manual steps required after applying the patches. The release notes flag a parallel GIN index build bug that leaves reltuples set to Infinity or NaN. Affected tables will never get vacuumed or analyzed. Run the diagnostic query from the release notes to check your cluster, then ANALYZE the affected tables. btree_gist indexes on float columns containing NaN or bit columns need a reindex as well. ltree users should reindex affected indexes due to an integer overflow that corrupts B-tree entries.
PostgreSQL 14 will reach end-of-life on November 12, 2026. The project strongly recommends you upgrade to a supported version before that date. If you're still on PG 14, this patch is the last one you'll get. The maintenance releases are cumulative, so you can stop the server, replace the binaries, and restart without a dump or pg_upgrade.
Head here to grab the downloads.
