Cherry-pick recent CVE fixes#1736

Open

reshke wants to merge 18 commits into

apache:mainfrom

Commits on May 11, 2026

Harden our regex engine against integer overflow in size calculations.

tglsfdc
authored and
reshke
committed
Prevent buffer overrun in unicode_normalize().

authored and
reshke
committed
Fix assorted places that need to use palloc_array().

tglsfdc
authored and
reshke
committed
Add raw_connect and raw_connect_works to Cluster.pm

michaelpq
authored and
reshke
committed
Fix unbounded recursive handling of SSL/GSS in ProcessStartupPacket()

michaelpq
authored and
reshke
committed
Unify src/common/'s definitions of MaxAllocSize.

tglsfdc
authored and
reshke
committed
Guard against overflow in "left" fields of query_int and ltxtquery.

tglsfdc
authored and
reshke
committed
Apply timingsafe_bcmp() in authentication paths

michaelpq
authored and
reshke
committed
Avoid passing unintended format codes to snprintf().

tglsfdc
authored and
reshke
committed
Guard against unsafe conditions in usage of pg_strftime().

tglsfdc
authored and
reshke
committed
Check CREATE privilege on multirange type schema in CREATE TYPE.

nathan-bossart
authored and
reshke
committed
Avoid overflow in size calculations in formatting.c.

nathan-bossart
authored and
reshke
committed
Prevent path traversal in pg_basebackup and pg_rewind

michaelpq
authored and
reshke
committed
Fix integer-overflow and alignment hazards in locale-related code.

tglsfdc
authored and
reshke
committed
Fix integer overflow in array_agg(), when the array grows too large

hlinnaka
authored and
reshke
committed
Mark PQfn() unsafe and fix overrun in frontend LO interface.

nathan-bossart
authored and
reshke
committed
refint: Fix SQL injection and buffer overruns.

nathan-bossart
authored and
reshke
committed

Commits on May 12, 2026

Merge branch 'main' into cp_cve
reshke
authored