* SECURITY UPDATE: arbitrary code execution as the server operating system user via type confusion in functions that take or return the "internal" pseudo-type, which the parser failed to block from SQL level calls - debian/patches/CVE-2026-14680.patch: reject INTERNALOID in can_coerce_type() and find_coercion_pathway(), raise an error when a function or operator accepts or returns internal in ParseFuncOrColumn() and make_op(), and refuse an I/O coercion to or from internal in get_cast_hashentry(), in src/backend/parser/parse_coerce.c, parse_func.c, parse_oper.c and src/pl/plpgsql/src/pl_exec.c - CVE-2026-14680 * SECURITY UPDATE: out of bounds write on 32-bit builds of plperl and pltcl where an object creator can wrap the size_t multiplication of an allocation and undersize it via a crafted function body - debian/patches/CVE-2026-14677.patch: route every element count times element size allocation through palloc_array(), palloc0_array(), palloc0_object() and the add_size()/mul_size() overflow guards, in src/pl/plperl/SPI.xs, src/pl/plperl/plperl.c and src/pl/tcl/pltcl.c - CVE-2026-14677 * SECURITY UPDATE: arbitrary code execution as the server operating system user via type confusion in the refint contrib module, whose plan cache reused a saved plan keyed only by trigger name and relation - debian/patches/CVE-2026-14671.patch: remove the refint plan cache entirely, dropping the EPlan struct, the FPlans and PPlans statics and find_plan(), and prepare the plan on every invocation into SPI context memory, in contrib/spi/refint.c plus the matching regression test updates in src/test/regress/sql/triggers.sql and expected/triggers.out - CVE-2026-14671 * SECURITY UPDATE: heap buffer overflow when a plperl function returns a "tied" Perl hash or array whose reported length changes between the count and the iteration - debian/patches/CVE-2026-14670.patch: stop trusting hv_iterinit() in plperl_to_hstore() by starting from a guessed capacity and growing the pairs array with repalloc_array() while passing the real filled count to hstoreUniquePairs(), and read the caller supplied dims[cur_depth - 1] instead of calling av_len() a second time in array_to_datum_internal(); additionally backport the follow-up hardening that stops plperl_func_handler() from looping forever on a tied array returned by a SETOF function by counting with av_count() and bounding it through the new av_count_limit() overflow guard, and that defends every plperl module against NULL "SV *" pointers returned by tied hashes and arrays, in contrib/hstore_plperl/hstore_plperl.c, contrib/jsonb_plperl/jsonb_plperl.c and src/pl/plperl/plperl.c - CVE-2026-14670 * SECURITY UPDATE: server memory disclosure through the ctid selectivity estimator, which dereferenced an arbitrary constant as an ItemPointer when an object creator supplied a non-ctid input - debian/patches/CVE-2026-14668.patch: require consttype == TIDOID before taking the SelfItemPointerAttributeNumber fast path in scalarineqsel(), in src/backend/utils/adt/selfuncs.c - CVE-2026-14668