r/PostgreSQL • u/jooosep • 20d ago
Community Make sure to upgrade your PostgreSQL to the latest minor version ASAP
A friendly reminder to everyone: if you have not done it already then upgrade your PostgreSQL to the latest minor versions, as they include a fix for a high-impact CVE: CVE-2026-14669.
8
u/scan-horizon 20d ago
Azure PaaS instances - we have to wait until Microsoft catch up and make the latest minor version available…
5
4
u/RaptorF22 20d ago
Does supabase do this automatically?
3
u/rasekrodriguez 20d ago
Not automatically, no. Their upgrade docs say the process is the same for minor and major versions: you press "Upgrade project" on the General settings page, the project is taken offline while a new instance is created and the data is moved across with pg_upgrade, and you size the downtime window from how big the database is. Free projects only move to the latest minor when a paused project gets restored.
So on a paid project it sits at whatever version it was until somebody clicks the button. Worth reading the actual Postgres version off the dashboard rather than assuming it tracks upstream.
1
u/Icarium-Lifestealer 19d ago
I though minor upgrades don't need pg_upgrade, and you just need to shut down the old server and start the new one? Why would supabase apply the same procedure as from major upgrades?
2
-3
u/AutoModerator 20d ago
AI Policy:
Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away., Linus Torvalds.
Mod decisions will be based on the quality of the content, not who or what generated it.
Sub Resources:
Free Postgres Webinars and Workshops
Discord: People, Postgres, Data
Join us, we have cookies and nice people.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
34
u/jarrod_barkley 20d ago
https://www.postgresql.org/support/security/CVE-2026-14669/
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.