diff --git a/doc/src/sgml/release-16.sgml b/doc/src/sgml/release-16.sgml
index cb3fb91adca..3d462d1c914 100644
--- a/doc/src/sgml/release-16.sgml
+++ b/doc/src/sgml/release-16.sgml
@@ -36,6 +36,183 @@
+
+ Guard against unexpected dimensions
+ of oidvector/int2vector (Tom Lane)
+ §
+
+
+
+ These data types are expected to be 1-dimensional arrays containing
+ no nulls, but there are cast pathways that permit violating those
+ expectations. Add checks to some functions that were depending on
+ those expectations without verifying them, and could misbehave in
+ consequence.
+
+
+
+ The PostgreSQL Project thanks
+ Altan Birler for reporting this problem.
+ (CVE-2026-2003)
+
+
+
+
+
+
+ Harden selectivity estimators against being attached to operators
+ that accept unexpected data types (Tom Lane)
+ §
+ §
+ §
+
+
+
+ contrib/intarray contained a selectivity
+ estimation function that could be abused for arbitrary code
+ execution, because it did not check that its input was of the
+ expected data type. Third-party extensions should check for similar
+ hazards and add defenses using the technique intarray now uses.
+ Since such extension fixes will take time, we now require superuser
+ privilege to attach a non-built-in selectivity estimator to an
+ operator.
+
+
+
+ The PostgreSQL Project thanks
+ Daniel Firer, as part of zeroday.cloud, for reporting this problem.
+ (CVE-2026-2004)
+
+
+
+
+
+
+ Fix buffer overrun in contrib/pgcrypto's
+ PGP decryption functions (Michael Paquier)
+ §
+
+
+
+ Decrypting a crafted message with an overlength session key caused a
+ buffer overrun, with consequences as bad as arbitrary code
+ execution.
+
+
+
+ The PostgreSQL Project thanks
+ Team Xint Code, as part of zeroday.cloud, for reporting this problem.
+ (CVE-2026-2005)
+
+
+
+
+
+
+ Fix inadequate validation of multibyte character lengths
+ (Thomas Munro, Noah Misch)
+ §
+ §
+ §
+ §
+ §
+ §
+
+
+
+ Assorted bugs allowed an attacker able to issue crafted SQL to
+ overrun string buffers, with consequences as bad as arbitrary code
+ execution. After these fixes, applications may
+ observe invalid byte sequence for encoding
errors
+ when string functions process invalid text that has been stored in
+ the database.
+
+
+
+ The PostgreSQL Project thanks Paul Gerste
+ and Moritz Sanft, as part of zeroday.cloud, for reporting this
+ problem.
+ (CVE-2026-2006)
+
+
+
+
+