PostgreSQL’s May update fixes 11 security issues and replication bugs

PostgreSQL released 18.4, 17.10, 16.14, 15.18 and 14.23 on May 14, addressing 11 security vulnerabilities and more than 60 bugs. The project announcement includes fixes affecting server authorization, client-side processing and replication operations.

Patch the operational toolchain too

One disclosed issue concerns large-object functions in libpq, with pg_dump and psql among the affected consumers. The release also repairs standby and logical-replication behavior, including a case where slot-synchronization workers could block promotion.

Our analysis is that an inventory limited to database server packages can miss part of this release’s value. Backup containers, administrative workstations and scheduled export jobs should be included in the version review. A patched server does not establish which client binary a recovery job will execute.

Treat maintenance as a recoverable change

The project says these cumulative minor releases do not ordinarily require a dump/reload or pg_upgrade. It also warns that users skipping earlier updates may have additional post-update work.

A practical rollout should preserve the starting versions of primaries, replicas and backup tools, then exercise a representative backup and restore with the intended binaries. Where standby promotion is part of the service’s recovery plan, include that path in the rehearsal rather than checking only that replication resumes.

For query-heavy services, compare a small set of important result sets as well as plans. The fixes include correctness changes, so “the query still runs” is a weak acceptance criterion. Begin by assigning an owner to each server and client package, and record completion against the installed version rather than the change ticket alone.