Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du…
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope…
Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl…
Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu…
Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running…
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr…
Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f…
SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression …
Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas…
Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi…
Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer…
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa…
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o…
Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an…
Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY …
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4…
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn…
Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O…
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count…
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t…
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th…
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via…
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection…
Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic…
Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows…
Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack…
databases/postgresql??-*: Update to latest versions
Update to 18.6, 17.11, 16.15, 15.19 and 14.24.
This release fixes 28 security vulnerabilities and over 110 bugs
reported over the last several months.
Welcome postgresql19 to the ports tree with 19-beta3.
Note: PostgreSQL 18.5 was skipped due to a regression; the fix
version is 18.6.
PostgreSQL 14 will stop receiving fixes on 2026-11-12.
Changes: https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
Security: 05d311bc-9991-11f1-bc50-6cc21735f730
databases/postgresql??-*: Upgrade to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18,
and 14.23. This release fixes 11 security vulnerabilities and over 60
bugs reported over the last several months.
Release notes: https://www.postgresql.org/docs/release/
PostgreSQL 14 EOL Notice
PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.
Security: 7185ecc9-4fb7-11f1-bc50-6cc21735f730
CVE-2026-6472, CVE-2026-6473, CVE-2026-6474,
CVE-2026-6475, CVE-2026-6476, CVE-2026-6477,
CVE-2026-6478, CVE-2026-6479, CVE-2026-6575,
CVE-2026-6637, CVE-2026-6638.
databases/postgresql??-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17,
and 14.22. This is an out-of-cycle release that fixes several
regressions reported after the last update release.
Release notes: https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/
https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes
databases/postgresql*-*: Update to latest version
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.2, 17.8, 16.12, 15.16,
and 14.21. This release fixes 5 security vulnerabilities and over 65
bugs reported over the last several months.
Release notes:
https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/
https://www.postgresql.org/docs/release/
Security:
CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
Remove postgresql13* since it is now EoL.
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15,
14.20, and 13.23. This release fixes 2 security vulnerabilities and over
50 bugs reported over the last several months.
This is the final release of PostgreSQL 13. PostgreSQL 13 is now
end-of-life and will no longer receive security and bug fixes.
Release notes: https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes
- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change
postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)
postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run
from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency
PR: 290587
Approved by: girgen
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19,
and 13.22, as well as the third beta release of PostgreSQL 18. This
release fixes 3 security vulnerabilities and over 55 bugs reported over
the last several months.
If you previously created a BRIN index using the
numeric_minmax_multi_ops operator class, please see the "Updating"
section for additional instructions after upgrading your instance.
For the full list of changes, please review the release notes.
Build client with ZSTD default [1].
Support promote and logrotate commans in RC-script. [2]
PR: 287225 [1], 288836 [2]
Security: fc048b51-7909-11f0-90a2-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
databases/postgresql1?-contrib: Fix plist issue for openssl=off
When OPENSSL=off, pgcrypto was not built but existed unconditionally in
the plist.
Noted by: Andrea Venturoli
databases/postgresql??-*: Update to latest version
PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.5, 16.9, 15.13, 14.18,
and 13.21. This release fixes 1 security vulnerability and over 60 bugs
reported over the last several months.
Security: 78b8e808-2c45-11f0-9a65-6cc21735f730
Release notes: https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/
databases/postgresql??-*: Upgrade to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.4, 16.8, 15.12, 14.17,
and 13.20.
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
Improve behavior of quoting functions in libpq. The fix for
CVE-2025-1094 caused the quoting functions to not honor their string
length parameters and, in some cases, cause crashes. This problem could
be noticeable from a PostgreSQL client library, based on how it is
integrated with libpq.
Fix small memory leak in pg_createsubscriber.
Also fix a problem in the FreeBSD port, where the rc script wouldn't
return properly, messing up orchestration tools like ansible. [1]
PR: 272502 [1]
Release notes: https://www.postgresql.org/docs/release/
databases/postgresql??-*: Update to latest versions
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.3, 16.7, 15.11, 14.16,
and 13.19. This release fixes 1 security vulnerability and over 70 bugs
reported over the last several months.
For the full list of changes, please review the release notes.
This commit also removes the broken support for Heimdal and fixes the
build when using MIT Kerberos. [1]
PR: 220325 suggested by Cullum Smith and many others. [1]
Release notes: https://www.postgresql.org/docs/release/
Security: fadf3b41-ea19-11ef-a540-6cc21735f730
databases/postgresql1{3,4,5,6,7}-client: Recommend py-psycopg over py-psycopg2
Upstream Python package maintainers recommend using the psycopg 3.x over
psycopg2 for new projects since the latter is in maintenance mode only.
Approved by: girgen (pgsql)
Differential Revision: https://reviews.freebsd.org/D48493
databases/postgresql??-*: Update to latest version
The issues listed below affect PostgreSQL 17. Some of these issues may
also affect other supported versions of PostgreSQL.
- Restore functionality of ALTER ROLE .. SET ROLE and ALTER DATABASE ..
SET ROLE. The fix for CVE-2024-10978 accidentally caused settings for
role to not be applied if they came from non-interactive sources,
including previous ALTER {ROLE|DATABASE} commands and the PGOPTIONS
environment variable.
- Restore compatibility for the timescaledb and other PostgreSQL
extensions built using PostgreSQL prior to the 2024-11-14 release
(17.0, 16.4, 15.8, 14.13, 13.16, 12.20, and earlier). This fix restores
struct ResultRelInfo to its previous size, so that affected extensions
don't need to be rebuilt.
- Fix cases where a logical replication slot's restart_lsn could go backwards.
- Avoid deleting still-needed WAL files during pg_rewind.
- Fix race conditions associated with dropping shared statistics
entries, which could lead to loss of statistics data.
- Fix crash with ALTER TABLE when checking to see if an index's opclass
options have changed if the table has an index with a non-default
operator class.
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
databases/postgresql??-*: Update to latest versions
PostgreSQL 17.1, 16.5, 15.9, 14.14, 13.17, and 12.21 Released!
The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.1, 16.5, 15.9, 14.14,
13.17, and 12.21. This release fixes 4 security vulnerabilities and over
35 bugs reported over the last several months.
Also add XML back as an active default option due to popular demand. [1]
Clean up the ports a bit.
PR: 269115 [1]
Release notes: https://www.postgresql.org/docs/release/
Security: a03636f4-a29f-11ef-af48-6cc21735f730
Security: 12e3feab-a29f-11ef-af48-6cc21735f730
Security: a61ef21b-a29e-11ef-af48-6cc21735f730
Security: 3831292b-a29d-11ef-af48-6cc21735f730
databases/postgresql17-*: Upgrade to RC1
Several bug fixes were applied for PostgreSQL 17 during the Beta 3
period. These include:
- Revert the MERGE/SPLIT partition feature.
- Fix for feature that improves performance around logical decoding of
subtransactions. For a detailed list of fixes, please visit the open
items [1] page.
[1]: https://wiki.postgresql.org/wiki/PostgreSQL_17_Open_Items#resolved_before_17rc1
Release notes: https://www.postgresql.org/about/news/postgresql-17-rc1-released-2926/