PostgreSQL Patches 52 Flaws: Which Version You Need

On November 12, 2026, the PostgreSQL project released versions 18.7, 17.12, 16.16, 15.20 and 14.25. They fix 52 security vulnerabilities, 32 of them scored 8.8 out of 10, and mark the end of support for PostgreSQL 14. Any website or app that stores its data in PostgreSQL should update.

What we know

The releases: according to the PostgreSQL Global Development Group announcement, all five supported branches were updated on November 12, 2026: 18.7, 17.12, 16.16, 15.20 and 14.25. The second release candidate of PostgreSQL 19 shipped alongside them.
How many flaws: the announcement lists 52 vulnerabilities, each with a CVE, plus more than 140 bug fixes. In that list, 32 carry a CVSS score of 8.8, and most of those allow code execution.
The headline flaw (CVE-2026-6460): per its postgresql.org advisory, a type confusion bug lets a user who can create or modify objects run code as the operating system user running the database. It requires an account with that privilege. Branches 14 through 18 are affected before the fixed releases.
One with no login (CVE-2026-116322): it only affects PostgreSQL 18 before 18.7. Per its advisory, an unauthenticated client that can reach the server over the network can force a restart. No data is exposed, but service is interrupted. Score: 5.3.
PostgreSQL 14 is done: the announcement says 14.25 is the last release of that branch and it will get no further fixes. The official versioning table lists November 11, 2027 as the end of PostgreSQL 15.
PostgreSQL 19: general availability is planned for November 19, 2026, unless another release candidate is needed.
Attacks: the announcement does not mention exploitation in the wild.

What changes and what doesn't

What changes: every supported branch has fixes worth applying now, and anyone still on PostgreSQL 14 or older is now without patches. Because many of the serious flaws require an account with certain privileges, the risk is higher, in this article's reading, wherever several apps or customers share one server, or where an app connects with more privileges than it needs.

What doesn't change: updating within a branch. The announcement says these releases are cumulative; you stop the service and replace the binaries, with no dump and reload and no pg_upgrade. It does add a few post-update tasks in specific cases.

How to tell if you're affected

Find out whether your site uses PostgreSQL. WordPress runs on MySQL or MariaDB, so a standard WordPress site is not affected. Drupal can run on PostgreSQL: in `settings.php`, the connection shows `'driver' => 'pgsql'`. Many custom apps and managed database platforms also run on PostgreSQL. If you're not sure, ask whoever maintains your site.
Check the server version. With database access, `SHOW server_version;` returns the number. You're current if it is at or above 18.7, 17.12, 16.16, 15.20 or 14.25 within its branch. Note that `psql --version` shows the client program, not the server.
On 14 or older, plan the move. 14.25 closes the branch. Moving to 15 or later is a major-version upgrade, via pg_upgrade or dump and reload, so test it on a copy of your site first.
On a managed database or shared hosting, ask. If you don't run the server, ask your provider for the exact version, when they will apply the fixed releases, and what they plan for customers still on 14.
Review the post-update tasks. The announcement calls for reindexing in specific cases: GIN indexes if corruption is suspected, GiST indexes using `gist_trgm_ops` (from the pg_trgm extension, common in on-site fuzzy search) and B-tree indexes on `bpchar` columns declared without a length. It also asks you to review `NOT NULL NO INHERIT` constraints on partitioned tables and, if you take incremental backups, to take a fresh full backup after updating.
Tighten privileges. Make sure the account your site connects with has only the privileges it needs and is not a superuser. That limits damage; it does not replace updating.

Sources

Updates: when PostgreSQL 19 reaches general availability or there is news on these flaws, it will be added here with a link.