Update postgresql to fix 2 security vulnerabilities: CVE-2026-2005, CVE-2026-2006

[ghosttigerllc-bit]

Chore

Describe the chore

Update postgresql to fix security vulnerabilities:

1. CVE-2026-2005:
   Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

2. CVE-2026-2006:
   Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

References

CVE-2026-2005

• https://nvd.nist.gov/vuln/detail/CVE-2026-2005
• https://www.postgresql.org/support/security/CVE-2026-2005

CVE-2026-2006

• https://nvd.nist.gov/vuln/detail/CVE-2026-2006
• https://www.postgresql.org/support/security/CVE-2026-2006

[brainrake]

Tracked by PR #2155, which bumps to PG 17.10 / 15.18 and absorbs the three upstream security cycles since 17.6/15.14 — including the Feb 2026 release (17.8/15.16) that fixes CVE-2026-2005 and CVE-2026-2006. Will close this once that PR merges.

[brainrake]

Closing in favor of the PR since it covers all the info here.