USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. (CVE-2026-6464)

It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER TABLE ALTER TYPE operations. An attacker could possibly use this issue to obtain sensitive information or gain unintended privileges. (CVE-2026-6469)

It was discovered that PostgreSQL failed to check the USAGE privilege on types. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-6470)

It was discovered that PostgreSQL logical decoding could load arbitrary shared libraries. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-6471)

It was discovered that PostgreSQL had integer wraparound issues in tsvector and tsquery allocations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14662)

It was discovered that PostgreSQL pgcrypto silently used cleartext when OpenSSL-disabled ciphers were requested. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14663)

It was discovered that PostgreSQL had a heap buffer overflow in regular expression processing. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14664)

It was discovered that PostgreSQL row security policies were not properly invalidated when roles were modified. An attacker could possibly use this issue to bypass intended row security restrictions. (CVE-2026-14666)

It was discovered that PostgreSQL had a type confusion issue in the selectivity estimator involving ctid. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14668)

It was discovered that PostgreSQL had a heap buffer overflow in the to_char function. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14669)

It was discovered that PostgreSQL had a heap buffer overflow in the PL/Perl tied object handling. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14670)

It was discovered that PostgreSQL had a type confusion issue in the referential integrity plan cache. An authenticated user could possibly use this issue to execute arbitrary code.