Postgresql: фикс для фикса на 9 из 10 (CVE-2026-2006)⁠⁠

Пока турбопатриоты рассказывали про аналоговнетные форки postgresql, и миллионы проверяющих глаз, к нему вышло срочное внепланое обновление для обновления

The PostgreSQL Global Development Group is planning for an out-of-cycle release on February 26, 2026 due to regressions introduced in the February 12, 2026 update release, which included releases 18.2, 17.8, 16.12, 15.16, and 14.21. This release will provide fixes for all supported versions (18.3, 17.9, 16.13, 15.17, 14.22). While these fixes may not impact all PostgreSQL users, the PostgreSQL Global Development Group wants to address these issues before the next scheduled release on May 14, 2026.

Out-of-cycle release scheduled for February 26, 2026

Дыра была с дом:

PostgreSQL missing validation of multibyte character length executes arbitrary code

Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
Overall Score 8.8

CVE-2026-2006

Затронуты были все поддерживаемые версии, от 14 до 18.

Проблема с фиксом была в том, что он тоже кривой:

The fix for CVE-2026-2006 was too aggressive and could raise an error about an incomplete character in cases that are actually valid.

Fix oversight in the fix for CVE-2026-2007 (Zsolt Parragi)

PostgreSQL 18.3