postgresql1[4-8]*: updated to 18.2, 17.8, 16.12, 15.16, and 14.21
PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
Security Issues
CVE-2026-2003: PostgreSQL oidvector discloses a few bytes of memory
CVSS v3.1 Base Score: 4.3
Supported, Vulnerable Versions: 14 - 18.
Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.
The PostgreSQL project thanks Altan Birler for reporting this problem.
CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code
CVSS v3.1 Base Score: 8.8
[61 lines not shown]
powerdns-recursor: update to 5.3.5.
Provided by Marcin Gondek in wip.
5.3.5
Released: 9th of February 2026
Bug Fixes
Fix PowerDNS Security Advisory 2026-01: Crafted zones can lead to increased resource usage in Recursor.
Move searchPhrase tokenization to ApiMutableControllerBase searchBase()
Determine if search_tokens contain a valid UUID, if yes collect the uuid field so it can be searched. Doing this prevents finding partial strings in UUIDs, but allows to find exact UUIDs.
Inside UIModelGrid fetchBindRequest(), use the search_tokens directly. A compatability case makes this backwards compatible for callers that do not know about search_tokens.
Pass the search_tokens directky into UIModelGrid fetch() instead of the raw searchPhrase.
www/googler: Deprecate and set to expire on 2026-04-13
- Upstream repository was archived on 2022-03-05; as alternative you can
install www/ddgr.
PR: 292163