PostgreSQL November Update Fixes 52 Vulnerabilities and Requires Post-Update Checks
Tech GuruQuick Answer
Install the fixed minor release for each major branch and restart the service. Review the release notes for index repair, partition-constraint checks and a new full backup where incremental backups are used.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory server and client binaries, extensions, replicas, backup tools and the PostgreSQL major versions they use. Match each CVE to the project security matrix. Do not assume every issue affects every major version or that an application is vulnerable solely because PostgreSQL is installed. Use supported distribution or project packages for the installed branch. Minor updates do not require pg_upgrade or a dump/reload. Follow branch-specific release notes for required post-update maintenance. Verify running versions and replica health; test application transactions and restore procedures. Review affected GIN, pg_trgm GiST, bpchar B-tree and TOAST indexes, partition constraints, and incremental-backup baselines. Retain package, maintenance and validation records.
Last verified: 2026-11-12 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | PostgreSQL server, client utilities and affected bundled modules |
|---|---|
| Advisory | PostgreSQL-2026-11-12 |
| CVEs | CVE-2026-116303, CVE-2026-116304, CVE-2026-116306, CVE-2026-116307, CVE-2026-116308, CVE-2026-116309, CVE-2026-116310, CVE-2026-116311, CVE-2026-116312, CVE-2026-116313, CVE-2026-116314, CVE-2026-116315, CVE-2026-116316, CVE-2026-116317, CVE-2026-116318, CVE-2026-116319, CVE-2026-116320, CVE-2026-116321, CVE-2026-116322, CVE-2026-116323, CVE-2026-116325, CVE-2026-116326, CVE-2026-116327, CVE-2026-116328, CVE-2026-116329, CVE-2026-116330, CVE-2026-116331, CVE-2026-116332, CVE-2026-116333, CVE-2026-116335, CVE-2026-116336, CVE-2026-120139, CVE-2026-120141, CVE-2026-120142, CVE-2026-120143, CVE-2026-120144, CVE-2026-120145, CVE-2026-120146, CVE-2026-120147, CVE-2026-120148, CVE-2026-120149, CVE-2026-120150, CVE-2026-120151, CVE-2026-120152, CVE-2026-120153, CVE-2026-120154, CVE-2026-14661, CVE-2026-16237, CVE-2026-16240, CVE-2026-18447, CVE-2026-6460, CVE-2026-6467 |
| Authoritative release date | November 12, 2026 at 14:08:08 UTC, from the project announcement message; the release page gives November 12. |
| Authority revision date | No separate revision date is stated. Individual advisory pages label their scoring version differently from the release announcement; the listed 8.8 maximum is preserved without inferring a severity label. |
| Affected versions | Affected components on PostgreSQL 14 through 18 before the fixed minor releases. Version applicability differs by CVE; use the official security matrix for each installed branch and component. |
| Fixed version | PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25, according to the installed major branch |
| CVSS base score | 8.8 (highest base score listed in the official release announcement) |
| CVSS severity | Not provided by the authority |
| Exploitation status | The cited project announcement does not confirm exploitation in the wild.; no exploitation claim is inferred. |
What Changed
The project releases 52 security fixes spanning code execution, privilege and row-security checks, and information disclosure. PostgreSQL 14.25 is the final PostgreSQL 14 release; plan migration to a supported major version.
What To Validate Now
- Inventory. Inventory server and client binaries, extensions, replicas, backup tools and the PostgreSQL major versions they use.
- Establish applicability. Match each CVE to the project security matrix. Do not assume every issue affects every major version or that an application is vulnerable solely because PostgreSQL is installed.
- Remediate. Use supported distribution or project packages for the installed branch. Minor updates do not require pg_upgrade or a dump/reload. Follow branch-specific release notes for required post-update maintenance.
- Validate. Verify running versions and replica health; test application transactions and restore procedures. Review affected GIN, pg_trgm GiST, bpchar B-tree and TOAST indexes, partition constraints, and incremental-backup baselines. Retain package, maintenance and validation records.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Coordinate service restarts and potentially disruptive reindexing. PostgreSQL 14 no longer receives fixes after 14.25. PostgreSQL 19 RC 2 remains a release candidate, not a general-availability production upgrade target.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
