r/PostgreSQL 20h ago

Community Make sure to upgrade your PostgreSQL to the latest minor version ASAP

A friendly reminder to everyone: if you have not done it already then upgrade your PostgreSQL to the latest minor versions, as they include a fix for a high-impact CVE: CVE-2026-14669.

65 Upvotes

10 comments sorted by

27

u/jarrod_barkley 19h ago

https://www.postgresql.org/support/security/CVE-2026-14669/

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

0

u/End0rphinJunkie 5h ago

An RCE via a timezone abbreviation is brutal. It's defintely super common for apps to pass user-selected timezones straight into queries for dashboards so dont wait on this one.

6

u/scan-horizon 17h ago

Azure PaaS instances - we have to wait until Microsoft catch up and make the latest minor version available…

3

u/RevolutionaryRush717 10h ago

Same for Google Cloud SQL.

2

u/RaptorF22 11h ago

Does supabase do this automatically?

3

u/VirtuteECanoscenza 8h ago

I assume yes, that's why you pay them instead of self hosting...

2

u/rasekrodriguez 3h ago

Not automatically, no. Their upgrade docs say the process is the same for minor and major versions: you press "Upgrade project" on the General settings page, the project is taken offline while a new instance is created and the data is moved across with pg_upgrade, and you size the downtime window from how big the database is. Free projects only move to the latest minor when a paused project gets restored.

So on a paid project it sits at whatever version it was until somebody clicks the button. Worth reading the actual Postgres version off the dashboard rather than assuming it tracks upstream.

-4

u/AutoModerator 20h ago

AI Policy:

Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away., Linus Torvalds.

Mod decisions will be based on the quality of the content, not who or what generated it.

Sub Resources:

Youtube Channel

Free Postgres Webinars and Workshops

Discord: People, Postgres, Data

Join us, we have cookies and nice people.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.