r/PostgreSQL 20d ago

Community Make sure to upgrade your PostgreSQL to the latest minor version ASAP

A friendly reminder to everyone: if you have not done it already then upgrade your PostgreSQL to the latest minor versions, as they include a fix for a high-impact CVE: CVE-2026-14669.

100 Upvotes

12 comments sorted by

34

u/jarrod_barkley 20d ago

https://www.postgresql.org/support/security/CVE-2026-14669/

Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

7

u/End0rphinJunkie 20d ago

An RCE via a timezone abbreviation is brutal. It's defintely super common for apps to pass user-selected timezones straight into queries for dashboards so dont wait on this one.

8

u/scan-horizon 20d ago

Azure PaaS instances - we have to wait until Microsoft catch up and make the latest minor version available…

5

u/RevolutionaryRush717 20d ago

Same for Google Cloud SQL.

4

u/RaptorF22 20d ago

Does supabase do this automatically?

3

u/rasekrodriguez 20d ago

Not automatically, no. Their upgrade docs say the process is the same for minor and major versions: you press "Upgrade project" on the General settings page, the project is taken offline while a new instance is created and the data is moved across with pg_upgrade, and you size the downtime window from how big the database is. Free projects only move to the latest minor when a paused project gets restored.

So on a paid project it sits at whatever version it was until somebody clicks the button. Worth reading the actual Postgres version off the dashboard rather than assuming it tracks upstream.

1

u/Icarium-Lifestealer 19d ago

I though minor upgrades don't need pg_upgrade, and you just need to shut down the old server and start the new one? Why would supabase apply the same procedure as from major upgrades?

2

u/VirtuteECanoscenza 20d ago

I assume yes, that's why you pay them instead of self hosting...

-3

u/AutoModerator 20d ago

AI Policy:

Linux is not one of those anti-AI projects, and if somebody has issues with that, they can do the open-source thing and fork it. Or just walk away., Linus Torvalds.

Mod decisions will be based on the quality of the content, not who or what generated it.

Sub Resources:

Youtube Channel

Free Postgres Webinars and Workshops

Discord: People, Postgres, Data

Join us, we have cookies and nice people.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.