Cherry-pick 14.23 CVE fixes in REL_2_STABLE #1791

Open

reshke wants to merge 22 commits into

apache:REL_2_STABLEfrom

reshke:cp_cve_rel_2_stable

Commits on May 30, 2026

Harden our regex engine against integer overflow in size calculations.

tglsfdc
authored and
reshke
committed
Prevent buffer overrun in unicode_normalize().

authored and
reshke
committed
Fix assorted places that need to use palloc_array().

tglsfdc
authored and
reshke
committed
Add raw_connect and raw_connect_works to Cluster.pm

michaelpq
authored and
reshke
committed
Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()

michaelpq
authored and
reshke
committed
Unify src/common/'s definitions of MaxAllocSize.

tglsfdc
authored and
reshke
committed
Guard against overflow in "left" fields of query_int and ltxtquery.

tglsfdc
authored and
reshke
committed
Apply timingsafe_bcmp() in authentication paths

michaelpq
authored and
reshke
committed
Avoid passing unintended format codes to snprintf().

tglsfdc
authored and
reshke
committed
Guard against unsafe conditions in usage of pg_strftime().

tglsfdc
authored and
reshke
committed
Check CREATE privilege on multirange type schema in CREATE TYPE.

nathan-bossart
authored and
reshke
committed
Avoid overflow in size calculations in formatting.c.

nathan-bossart
authored and
reshke
committed
Prevent path traversal in pg_basebackup and pg_rewind

michaelpq
authored and
reshke
committed
Fix integer-overflow and alignment hazards in locale-related code.

tglsfdc
authored and
reshke
committed
Fix integer overflow in array_agg(), when the array grows too large

hlinnaka
authored and
reshke
committed
Mark PQfn() unsafe and fix overrun in frontend LO interface.

nathan-bossart
authored and
reshke
committed
refint: Fix SQL injection and buffer overruns.

nathan-bossart
authored and
reshke
committed
Partally apply 37842f3dc6c
reshke
committed
Add timingsafe_bcmp(), for constant-time memory comparison

authored and
reshke
committed
Make palloc_array() and friends safe against integer overflow.

tglsfdc
authored and
reshke
committed
Adapt cloubderry mock generator for pg_noinline function attribute
reshke
committed
Fix rebase issue in ac34fdb2af95
reshke
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Cherry-pick 14.23 CVE fixes in REL_2_STABLE #1791

Cherry-pick 14.23 CVE fixes in REL_2_STABLE #1791
reshke wants to merge 22 commits into
apache:REL_2_STABLEfrom
reshke:cp_cve_rel_2_stable

Commits on May 30, 2026

Harden our regex engine against integer overflow in size calculations.

Prevent buffer overrun in unicode_normalize().

Fix assorted places that need to use palloc_array().

Add raw_connect and raw_connect_works to Cluster.pm

Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()

Unify src/common/'s definitions of MaxAllocSize.

Guard against overflow in "left" fields of query_int and ltxtquery.

Apply timingsafe_bcmp() in authentication paths

Avoid passing unintended format codes to snprintf().

Guard against unsafe conditions in usage of pg_strftime().

Check CREATE privilege on multirange type schema in CREATE TYPE.

Avoid overflow in size calculations in formatting.c.

Prevent path traversal in pg_basebackup and pg_rewind

Fix integer-overflow and alignment hazards in locale-related code.

Fix integer overflow in array_agg(), when the array grows too large

Mark PQfn() unsafe and fix overrun in frontend LO interface.

refint: Fix SQL injection and buffer overruns.

Partally apply 37842f3dc6c

Add timingsafe_bcmp(), for constant-time memory comparison

Make palloc_array() and friends safe against integer overflow.

Adapt cloubderry mock generator for pg_noinline function attribute

Fix rebase issue in ac34fdb2af95