diff --git a/doc/src/sgml/release-16.sgml b/doc/src/sgml/release-16.sgml index cb3fb91adca..3d462d1c914 100644 --- a/doc/src/sgml/release-16.sgml +++ b/doc/src/sgml/release-16.sgml @@ -36,6 +36,183 @@ + + Guard against unexpected dimensions + of oidvector/int2vector (Tom Lane) + § + + + + These data types are expected to be 1-dimensional arrays containing + no nulls, but there are cast pathways that permit violating those + expectations. Add checks to some functions that were depending on + those expectations without verifying them, and could misbehave in + consequence. + + + + The PostgreSQL Project thanks + Altan Birler for reporting this problem. + (CVE-2026-2003) + + + + + + + Harden selectivity estimators against being attached to operators + that accept unexpected data types (Tom Lane) + § + § + § + + + + contrib/intarray contained a selectivity + estimation function that could be abused for arbitrary code + execution, because it did not check that its input was of the + expected data type. Third-party extensions should check for similar + hazards and add defenses using the technique intarray now uses. + Since such extension fixes will take time, we now require superuser + privilege to attach a non-built-in selectivity estimator to an + operator. + + + + The PostgreSQL Project thanks + Daniel Firer, as part of zeroday.cloud, for reporting this problem. + (CVE-2026-2004) + + + + + + + Fix buffer overrun in contrib/pgcrypto's + PGP decryption functions (Michael Paquier) + § + + + + Decrypting a crafted message with an overlength session key caused a + buffer overrun, with consequences as bad as arbitrary code + execution. + + + + The PostgreSQL Project thanks + Team Xint Code, as part of zeroday.cloud, for reporting this problem. + (CVE-2026-2005) + + + + + + + Fix inadequate validation of multibyte character lengths + (Thomas Munro, Noah Misch) + § + § + § + § + § + § + + + + Assorted bugs allowed an attacker able to issue crafted SQL to + overrun string buffers, with consequences as bad as arbitrary code + execution. After these fixes, applications may + observe invalid byte sequence for encoding errors + when string functions process invalid text that has been stored in + the database. + + + + The PostgreSQL Project thanks Paul Gerste + and Moritz Sanft, as part of zeroday.cloud, for reporting this + problem. + (CVE-2026-2006) + + + + +