PostgreSQL 17.11 and 15.19 security updates for Debian 13 and 12 (DSA-6438-1, DLA-4740-1)

Debian has released security updates for PostgreSQL: DSA-6438-1 for postgresql-17 in Debian 13 (trixie) on 13 August 2026, and DLA-4740-1 for postgresql-15 in Debian 12 (bookworm) a day later. They bring the upstream 17.11 and 15.19 releases, which close more than two dozen vulnerabilities in the server, contrib modules and the psql and pg_dump client tools. A few fixes need a short configuration or data check after you update.

At a glance

What the vulnerabilities are

Debian summarises the impact as possible execution of arbitrary code, incorrect authentication, information disclosure or privilege escalation. Upstream, the PostgreSQL project released 18.6, 17.11, 16.15, 15.19 and 14.24 on 13 August 2026, fixing 28 security vulnerabilities and over 110 bugs. The issues fall into four groups:

• Server bugs reachable by logged-in users. Several memory-safety and type-confusion bugs, such as CVE-2026-16239 (re-creating a cursor with different types), could let an ordinary database user run code as the operating-system user that runs PostgreSQL. CVE-2026-15741 allows SQL injection through the deparsing of an EXTRACT argument. PostgreSQL rates these 8.8.
• Logical decoding. CVE-2026-6471 (7.2) let a replication user load any loadable library as a logical decoding output plugin. The fix adds a new server setting, output_plugin_libraries.
• Client tools. Bugs in psql and pg_dump could run code on the machine where you run them: CVE-2026-19385 (pg_dump heap overflow via a crafted transform list), CVE-2026-18408 (psql \unrestrict, abused by a superuser of the server a dump came from) and CVE-2026-6464 (psql treating in-line COPY data as commands after an early failure).
• Encryption. With CVE-2026-14663, pgcrypto PGP encryption using a cipher that OpenSSL refuses (for example blowfish, cast5 or 3des in FIPS mode or without the legacy provider) silently produced data that was not really encrypted. CVE-2026-14681 (PostgreSQL 17 and 18 only) concerns GSSAPI encryption combined with SSL.

The bookworm DLA also carries CVE-2025-8714, an older pg_dump issue. None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog, and the CVE records we checked show CISA's exploitation assessment as none.

Are you affected?

Debian 13 ships PostgreSQL 17 and Debian 12 ships PostgreSQL 15. List what is installed and compare the Installed line with the fixed version:

dpkg -l 'postgresql*' libpq5 | grep '^ii'
apt policy postgresql-17 postgresql-client-17 libpq5   # Debian 13
apt policy postgresql-15 postgresql-client-15 libpq5   # Debian 12

Client-only machines count too: a backup host or workstation with only postgresql-client-17 and libpq5 still needs the update because of the psql and pg_dump fixes. If you installed PostgreSQL from the PostgreSQL project's own apt repository instead of Debian's archive, your updates come from there; make sure the server reports 17.11, 15.19 or later.

How to update

sudo apt update
sudo apt upgrade

To update only PostgreSQL on Debian 13 (use 15 instead of 17 on Debian 12):

sudo apt install --only-upgrade postgresql-17 postgresql-client-17 libpq5

A full apt upgrade also updates extension packages such as postgresql-17-wal2json and the PL packages (postgresql-plperl-17 and similar).

Restart or reboot?

No reboot is needed. The package upgrade normally restarts running clusters; confirm it:

pg_lsclusters
sudo -u postgres psql -c 'SELECT version();'

If a cluster still reports the old version, restart it with sudo systemctl restart postgresql@17-main (take the version and cluster name from pg_lsclusters). Programs that load libpq5, such as PHP-FPM with the pgsql extension, keep the old library until they restart; sudo needrestart lists them.

Post-update checks

• Third-party logical decoding plugins. Debian notes that the CVE-2026-6471 fix needs configuration if you use postgresql-17-wal2json, postgresql-17-squeeze, postgresql-17-pg-rewrite or postgresql-17-decoderbufs (on bookworm: postgresql-15-wal2json, postgresql-15-decoderbufs). Add the plugin to /etc/postgresql/17/main/postgresql.conf, for example output_plugin_libraries = 'pgoutput, test_decoding, wal2json', then restart the cluster. List only plugins you trust.
• pgcrypto. Data affected by CVE-2026-14663 will no longer decrypt by default; the 17.11 release notes describe the ignore-cipher-failure option for recovering it and re-encrypting with a modern algorithm.
• psql scripts. Test scripts that deliberately run a failing COPY ... FROM STDIN now need a \. terminator line.
• Indexes. Reindex btree_gist indexes on float columns that may contain NaN, and btree indexes over ltree values with more than about 14,653 labels.

Sources

• security-tracker.debian.org/tracker/DSA-6438-1
• debian.org/security/2026/dsa-6438
• lists.debian.org/debian-security-announce/2026/msg00349.html
• security-tracker.debian.org/tracker/DLA-4740-1
• lists.debian.org/debian-lts-announce/2026/08/msg00029.html
• postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365
• postgresql.org/support/security
• postgresql.org/docs/release/17.11
• postgresql.org/docs/release/15.19
• cve.org/CVERecord?id=CVE-2026-16239
• cve.org/CVERecord?id=CVE-2026-19385
• cve.org/CVERecord?id=CVE-2026-6471
• cisa.gov/known-exploited-vulnerabilities-catalog
• packages.debian.org/source/trixie/postgresql-17
• manpages.debian.org/trixie/postgresql-common/pg_lsclusters.1.en.html
• manpages.debian.org/trixie/postgresql-common/pg_ctlcluster.1.en.html
• debian.org/releases