POSTGRESQL SHIPS SECURITY UPDATES

Abstract

CVE-2025-8713 covers a statistics exposure path that could allow a user to infer sampled data in a view, partition, or child table, potentially bypassing access controls or row-level security; fixes extend to supported releases back to version 13. CVE- 2025-8714 and CVE-2025-8715 both involve restore-time code execution vectors—one via untrusted data crafted by a superuser on the origin server and another via improper newline handling in object names—with implications for client systems running and for the restore target server. Additional items touch WAL retention during checkpoints, GSSAPI authentication stability, the handling of nested character classes in, and regression fixes that restore expected behavior for PL/pgSQL parallelization and certain MERGE edge cases.

The PostgreSQL Global Development Group has released a coordinated set of updates—versions 17.6, 16.10, 15.14, 14.19, and 13.22—alongside PostgreSQL 18 Beta 3, addressing security issues and more than 55 bug fixes accumulated over recent months. Published on August 14, 2025, the update cycle underscores PostgreSQL's practice of shipping cross- version patches that production teams can apply without dump-and-reload. For administrators, the message is clear: review the changelog, patch promptly, and run the recommended maintenance where applicable. Three CVEs are highlighted. CVE-2025-8713 covers a statistics exposure path that could allow a user to infer sampled data in a view, partition, or child table, potentially bypassing access controls or row-level security; fixes extend to supported releases back to version 13. CVE- 2025-8714 and CVE-2025-8715 both involve restore-time code execution vectors—one via untrusted data crafted by a superuser on the origin server and another via improper newline handling in object names—with implications for client systems running and for the restore target server. These issues receive 8.8 CVSSv3 base scores, warranting timely remediation in environments that frequently exchange dumps between instances. Beyond security, the release notes call out a set of reliability and performance fixes. Administrators using BRIN indexes with the operator class are advised to reindex after upgrading to address potential bloat and inefficiency. Logical replication receives multiple corrections—including fixes for duplicate transaction replay and infinite waits— that reduce risk in architectures using logical slots for change propagation or downstream processing. Additional items touch WAL retention during checkpoints, GSSAPI authentication stability, the handling of nested character classes in, and regression fixes that restore expected behavior for PL/pgSQL parallelization and certain MERGE edge cases. On the forward-looking side, PostgreSQL 18 Beta 3 moves the community closer to a general availability target around September/October 2025, with the project encouraging broad testing on non-production systems. Changes since Beta 2 include performance and stability improvements (for example, fixes to background workers after crashes and a rare asynchronous I/O failure), as well as cleanup in dump utilities. The project's guidance remains consistent: test your typical workloads against the beta, report issues, and expect minor behavioral adjustments as the release is finalized. Organizations still running PostgreSQL 13 should note the end-of-life date of November 13, 2025. Planning upgrades now helps avoid churn later, especially for systems that require extended validation cycles or that maintain many replication subscribers. Because PostgreSQL minor updates are cumulative, teams that have skipped one or more patch cycles should consult prior notes for any post-update tasks they may need to run in sequence. For database reliability teams, the practical next steps include scheduling patch windows, reindexing the affected BRIN indexes where relevant, and reviewing backup/restore workflows for exposure to the vectors discussed. The coordinated update cadence—security, correctness, and incremental improvements across supported versions—continues to be one of PostgreSQL's operational strengths for enterprises that standardize on the database across fleets. About The PostgreSQL The PostgreSQL Global Development Group stewards the open- source PostgreSQL relational database, coordinating community contributions, releases, and security updates. For more information, visit www.postgresql.org.