CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

databases/postgresql18-server 18.6

PostgreSQL is the most advanced open-source database available anywhere

Maintainer
pgsql@FreeBSD.org
Packages
latest: 18.6
Upstream
up to date
Last update
to 18.6 · 60c44ec8a9
Quarterly
2026Q4: 18.6
WWW
https://www.postgresql.org/
Links
cgit · VuXML

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 18.6.

Fixed (3)

Show 3 fixed
VuXML entries whose affected range the packaged version has left.

Problem reports (1) · open in Bugzilla, most recently changed first

PRSummaryStatusChanged
297818databases/postgresql18-server: ERROR: time zone "UTC" appears to use leap secondsNew2026-09-12

Commits (14)

Palle Girgensohn (girgen) · 18.6 MFH 2026Q3 ✓
databases/postgresql??-*: Update to latest versions

Update to 18.6, 17.11, 16.15, 15.19 and 14.24.

This release fixes 28 security vulnerabilities and over 110 bugs
reported over the last several months.

Welcome postgresql19 to the ports tree with 19-beta3.

Note: PostgreSQL 18.5 was skipped due to a regression; the fix
version is 18.6.

PostgreSQL 14 will stop receiving fixes on 2026-11-12.

Changes:	https://www.postgresql.org/about/news/postgresql-186-1711-1615-1519-1424-and-19-beta-3-released-3365/
Security:	05d311bc-9991-11f1-bc50-6cc21735f730
60c44ec8a9
Palle Girgensohn (girgen) · 18.4
databases/postgresql??-*: Upgrade to latest version

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.4, 17.10, 16.14, 15.18,
and 14.23. This release fixes 11 security vulnerabilities and over 60
bugs reported over the last several months.

Release notes:	https://www.postgresql.org/docs/release/

PostgreSQL 14 EOL Notice

PostgreSQL 14 will stop receiving fixes on November 12, 2026. If you are
running PostgreSQL 14 in a production environment, we suggest that you
make plans to upgrade to a newer, supported version of PostgreSQL.
Please see our versioning policy for more information.

Security:	7185ecc9-4fb7-11f1-bc50-6cc21735f730
		CVE-2026-6472, CVE-2026-6473, CVE-2026-6474,
		CVE-2026-6475, CVE-2026-6476, CVE-2026-6477,
		CVE-2026-6478, CVE-2026-6479, CVE-2026-6575,
		CVE-2026-6637, CVE-2026-6638.
1b9564eb70
Palle Girgensohn (girgen) · 18.3
databases/postgresql??-*: Update to latest version

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.3, 17.9, 16.13, 15.17,
and 14.22. This is an out-of-cycle release that fixes several
regressions reported after the last update release.

Release notes:	https://www.postgresql.org/about/news/postgresql-183-179-1613-1517-and-1422-released-3246/
		https://wiki.postgresql.org/wiki/2026-02_Regression_Fixes
a6361f4a39
Palle Girgensohn (girgen) · 18.2
databases/postgresql*-*: Update to latest version

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.2, 17.8, 16.12, 15.16,
and 14.21. This release fixes 5 security vulnerabilities and over 65
bugs reported over the last several months.

Release notes:
https://www.postgresql.org/about/news/postgresql-182-178-1612-1516-and-1421-released-3235/
https://www.postgresql.org/docs/release/

Security:
CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code
CVE-2026-2007: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory

Remove postgresql13* since it is now EoL.
52f5d9e988
Romain Tartière (romain) · 18.1_1
databases/postgresql*-server: Unbreak after llvm11 removal

LLVM 11 was removed in this commit:
313d56689aae7c9efa4e8ed34d5d5ecf9e42840d

The minimum requirement cannot be enforced anymore.  Remove it
completely.

Approved by:	portmgr blanket
e76ad397c2
Palle Girgensohn (girgen) · 18.1_1
databases/postgresql??-*: Update to latest versions

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15,
14.20, and 13.23. This release fixes 2 security vulnerabilities and over
50 bugs reported over the last several months.

This is the final release of PostgreSQL 13. PostgreSQL 13 is now
end-of-life and will no longer receive security and bug fixes.

Release notes:	https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/
b5e55910e2
Po-Chuan Hsieh (sunpoet) · 18.0_1
databases/postgresql{13,14,15,16,17,18}-*: Multiple fixes

- Strip shared library and binary executable
- Fix stage-qa
- Bump PORTREVISION for package change

postgresql{13,14,15,16,17,18}-server:
- Clean up Makefile: Remove unnecessary ";\"
- Sort PLIST: share/locale comes before DATADIR (share/postgresql)

postgresql{17,18}-plperl:
- Remove duplicate USES=perl5
- Add missing USE_PERL5=run

from postgresql{17,18}-plperl build log:
====> Running Q/A tests (stage-qa)
Error: /usr/local/lib/postgresql/bool_plperl.so is linked to /usr/local/lib/perl5/5.40/mach/CORE/libperl.so.5.40 from lang/perl5.40 but it is not declared as a dependency

PR:		290587
Approved by:	girgen
a626924cf2
Palle Girgensohn (girgen) · 18.0
databases/postgresql18-*: Update to 18.0

PostgreSQL 18 improves performance for workloads of all sizes through a
new I/O subsystem that has demonstrated up to 3× performance
improvements when reading from storage, and also increases the number of
queries that can use indexes. This release makes major-version upgrades
less disruptive, accelerating upgrade times and reducing the time
required to reach expected performance after an upgrade completes.
Developers also benefit from PostgreSQL 18 features, including virtual
generated columns that compute values at query time, and the
database-friendly uuidv7() function that provides better indexing and
read performance for UUIDs. PostgreSQL 18 makes it easier to integrate
with single-sign on (SSO) systems with support for OAuth 2.0
authentication.

Release notes:	https://www.postgresql.org/about/news/postgresql-18-released-3142/
68d84485f8
Vanilla I. Shu (vanilla) · 18.r1
databases/postgresql*-client: install libpgfeutils.a, bump PORTREVISION.

Approved by:	girgen@
7609156ab5
Palle Girgensohn (girgen) · 18.r1
databases/postgresql18: Upgrade to RC 1

The PostgreSQL Global Development Group announces that the first release
candidate of PostgreSQL 18 is now available for download. As a release
candidate, PostgreSQL 18 RC 1 will be mostly identical to the initial
release of PostgreSQL 18, though some more fixes may be applied prior to
the general availability of PostgreSQL 18.

The planned date for the general availability of PostgreSQL 18 is
September 25, 2025. Please see the "Release Schedule" section for more
details.

To upgrade to PostgreSQL 18 RC 1 from earlier versions of PostgreSQL,
you will need to use a major version upgrade strategy, e.g. pg_upgrade
or pg_dump / pg_restore. For more information, please visit the
documentation section on upgrading:
 https://www.postgresql.org/docs/18/upgrading.html

Release notes:
- https://www.postgresql.org/about/news/postgresql-18-rc-1-released-3130/
- https://www.postgresql.org/docs/18/release-18.html
e8ae0a359b
Palle Girgensohn (girgen) · 18.b3
databases/postgresql??-*: Update to latest versions

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.6, 16.10, 15.14, 14.19,
and 13.22, as well as the third beta release of PostgreSQL 18. This
release fixes 3 security vulnerabilities and over 55 bugs reported over
the last several months.

If you previously created a BRIN index using the
numeric_minmax_multi_ops operator class, please see the "Updating"
section for additional instructions after upgrading your instance.

For the full list of changes, please review the release notes.

Build client with ZSTD default [1].
Support promote and logrotate commans in RC-script. [2]

PR:		287225 [1], 288836 [2]
Security:	fc048b51-7909-11f0-90a2-6cc21735f730
Release notes:	https://www.postgresql.org/about/news/postgresql-176-1610-1514-1419-1322-and-18-beta-3-released-3118/
69445f026f
Palle Girgensohn (girgen) · 18.b2
databases/postgresql1?-contrib: Fix plist issue for openssl=off

When OPENSSL=off, pgcrypto was not built but existed unconditionally in
the plist.

Noted by: Andrea Venturoli
ce8336b671
Palle Girgensohn (girgen) · 18.b2
databases/postgresql18: Update to 18 beta 2

Release notes:	https://www.postgresql.org/about/news/postgresql-18-beta-2-released-3103/
b4bda65283
Palle Girgensohn (girgen) · 18.b1
databases/postgresql??-*: Update to latest version

PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 Released!

The PostgreSQL Global Development Group has released an update to all
supported versions of PostgreSQL, including 17.5, 16.9, 15.13, 14.18,
and 13.21. This release fixes 1 security vulnerability and over 60 bugs
reported over the last several months.

Security:	78b8e808-2c45-11f0-9a65-6cc21735f730
Release notes:	https://www.postgresql.org/about/news/postgresql-175-169-1513-1418-and-1321-released-3072/
a9608d62ae