PostgreSQL — свободная объектно-реляционная система управления базами данных.

ELSA-2026-52395: postgresql security update (IMPORTANT)

Important: libpq security update

Important: libpq security update

ELSA-2026-44308: libpq security update (IMPORTANT)

ELSA-2026-44391: libpq security update (IMPORTANT)

Low: libpq security update

ELSA-2026-28208: postgresql:13 security update (IMPORTANT)

Important: postgresql:13 security update

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.