databases/postgresql??-*: Update to latest version The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17, and 14.22. This is an out-of-cycle release that fixes several regressions reported after the last update release. Release notes: https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/ https://wiki.postgresql.org/wiki/2026-02_Regression_Fixesa6361f4a39
Port details
databases/postgresql17-contrib 17.9
The contrib utilities from the PostgreSQL distribution
Port info
- Maintainer
- pgsql@FreeBSD.org
- Packages
- latest: 17.11, update to 17.9 not built yet
- Upstream
- up to date
- Last update
- to 17.11 via databases/postgresql17-server · 60c44ec8a9
- Quarterly
- 2026Q4: 17.11
- WWW
- https://www.postgresql.org/
- Links
- cgit · VuXML
Install
- Package
# pkg install postgresql17-contribinstalls 17.11 fromlatest; fromquarterly(2026Q4) 17.11- Port
# cd /usr/ports/databases/postgresql17-contrib && make install clean# make -C /usr/ports/databases/postgresql17-contrib config # change options first
- Size
- 524 KiB download · 1.9 MiB installed
- Depends on
- archivers/zstd 1.5.7_2, databases/postgresql17-client 17.11, textproc/libxml2 2.15.4
- License
- PostgreSQL
- Options
- 4 of 4 on in the package: DOCS OPENSSL XML ZSTD
- pkg-message
Shown after installing
The PostgreSQL contrib utilities have been installed. Please see /usr/local/share/doc/postgresql/README-contrib for more information.
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 17.11 | 17.11 | – |
| FreeBSD 15 | 17.11 | 17.11 | – |
| FreeBSD 14 | 17.11 | 17.11 | 17.11 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 17.11 | 17.11 | – |
| FreeBSD 14 | 17.11 | 17.11 | 17.11 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed and VuXML only (0)
No unaddressed CVE and nothing reported by
pkg audit for the packaged version 17.11.Fixed (26)
Show 26 fixed
VuXML entries whose affected range the packaged version has left, plus CVEs from the last 90 days that this version is already past (fixed by update).
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2026-19385 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du… |
| CVE-2026-18408 | 8.8 | 2026-08-13 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope… |
| CVE-2026-16238 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl… |
| CVE-2026-16239 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu… |
| CVE-2026-15742 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running… |
| CVE-2026-14677 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr… |
| CVE-2026-14680 | 8.8 | 2026-08-13 | Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f… |
| CVE-2026-15741 | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression … |
| CVE-2026-14669 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas… |
| CVE-2026-14670 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi… |
| CVE-2026-14671 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer… |
| CVE-2026-14664 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa… |
| CVE-2026-14662 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o… |
| CVE-2026-14679 | 8.2 | 2026-08-13 | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an… |
| CVE-2026-6464 | 8.1 | 2026-08-13 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY … |
| CVE-2026-14668 | 8.1 | 2026-08-13 | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4… |
| CVE-2026-6471 | 7.2 | 2026-08-13 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn… |
| CVE-2026-14663 | 6.5 | 2026-08-13 | Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O… |
| CVE-2026-14672 | 5.3 | 2026-08-13 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count… |
| CVE-2026-6470 | 4.3 | 2026-08-13 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t… |
| CVE-2026-18024 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th… |
| CVE-2026-14678 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via… |
| CVE-2026-14681 | 4.2 | 2026-08-13 | Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection… |
| CVE-2026-14666 | 4.2 | 2026-08-13 | Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic… |
| CVE-2026-6469 | 3.8 | 2026-08-13 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows… |
| CVE-2026-16241 | 3.8 | 2026-08-13 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack… |
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (5)
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgena626924cf2databases/postgresql??-*: Update to latest versions The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19, and 13.22, as well as the third beta release of PostgreSQL 18. This release fixes 3 security vulnerabilities and over 55 bugs reported over the last several months. If you previously created a BRIN index using the numeric_minmax_multi_ops operator class, please see the "Updating" section for additional instructions after upgrading your instance. For the full list of changes, please review the release notes. Build client with ZSTD default [1]. Support promote and logrotate commans in RC-script. [2] PR: 287225 [1], 288836 [2] Security: fc048b51-7909-11f0-90a2-6cc21735f730 Release notes: https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/69445f026f
libxml2: chase libxml soversion bump3068854dd0
databases/postgresql17-*: new ports: Beta of the new major version 17 of PostgreSQL Release notes: https://www.postgresql.org/docs/17/release-17.html7327472603