Backport PostgreSQL 14 21 security fixes#1812

Open

reshke wants to merge 12 commits into

apache:REL_2_STABLEfrom

reshke:cp_cve_14_21

Commits on Jun 8, 2026

pgcrypto: Fix buffer overflow in pgp_pub_decrypt_bytea()

michaelpq
authored and
reshke
committed
Fix encoding length for EUC_CN.

macdice
authored and
reshke
committed
Fix mb2wchar functions on short input.

macdice
authored and
reshke
committed
Code coverage for most pg_mblen* calls.

authored and
reshke
committed
Require PGP-decrypted text to pass encoding validation.

nmisch
authored and
reshke
committed
Guard against unexpected dimensions of oidvector/int2vector.

tglsfdc
authored and
reshke
committed
Add a syscache on pg_extension.oid.

tglsfdc
authored and
reshke
committed
Require superuser to install a non-built-in selectivity estimator.

tglsfdc
authored and
reshke
committed
Harden _int_matchsel() against being attached to the wrong operator.

tglsfdc
authored and
reshke
committed
Fix test "NUL byte in text decrypt" for --without-zlib builds.

nmisch
authored and
reshke
committed
Fix rebase and silence RAT check
reshke
committed
Replace pg_mblen() with bounds-checked versions.

authored and
reshke
committed