* SECURITY UPDATE: out-of-bounds reads in ascii(), where the function assumed the input string was long enough to hold a character of the length implied by its leading byte and relied on assertions to validate the remaining bytes, so crafted invalid multibyte input could read past the end of the string and disclose a few bytes of server memory - debian/patches/CVE-2026-18024.patch: check the character length against the bytes actually left in the input and replace the assertions on the byte values with ereport(ERROR, ...) reports in ascii() in src/backend/utils/adt/oracle_compat.c - CVE-2026-18024 * SECURITY UPDATE: stale cached plans after role changes, where role membership, role attribute and database ownership changes did not invalidate plans whose behaviour depends on the current role, so a cached plan could keep applying row-level security policies as they stood before the change - debian/patches/CVE-2026-14666.patch: add a PlanCacheRoleCallback() that invalidates the role-dependent saved plans and register it on the pg_auth_members, pg_authid and pg_database syscaches from InitPlanCache() in src/backend/utils/cache/plancache.c, and record the current database's syscache hash in cached_db_hash in src/backend/utils/adt/acl.c, exposed through src/include/utils/acl.h, so pg_database changes for other databases are ignored - CVE-2026-14666 * SECURITY UPDATE: silently disabled encryption in the pgcrypto PGP code, where the return value of px_cipher_encrypt() was never checked, so when OpenSSL ran in FIPS mode or without the legacy provider and could not initialise one of the ciphers the PGP code supports, the CFB layer XORed an unencrypted block with the plaintext and left the data effectively unencrypted - debian/patches/CVE-2026-14663.patch: check the px_cipher_encrypt() return value in cfb_process() and give pgp_cfb_create() an ignore_decrypt_cipher_failure argument in contrib/pgcrypto/pgp-cfb.c, pgp-decrypt.c, pgp-encrypt.c, pgp-pubkey.c, pgp.c and pgp.h, and add the ignore-cipher-failure decryption option in contrib/pgcrypto/pgp-pgsql.c so a message written by an already broken encryption can still be stripped back and re-encrypted, with matching doc/src/sgml/pgcrypto.sgml and regression test updates - CVE-2026-14663 * SECURITY UPDATE: out-of-bounds read in the pg_trgm GiST picksplit function, where the CACHESIGN sign field, which is a BITVECP rather than a TRGM, was passed through the GETSIGN() macro whose cast hid the mistake, so the signature size was computed from memory past the end of the buffer, giving bad split decisions or a crash - debian/patches/CVE-2026-14678.patch: pass cache[j].sign straight to sizebitvec() instead of wrapping it in GETSIGN() in gtrgm_picksplit() in contrib/pg_trgm/trgm_gist.c - CVE-2026-14678