* SECURITY UPDATE: unrestricted library load during logical decoding, where a user holding the REPLICATION privilege could execute arbitrary code as the operating system user running the database by naming any shared library as the output plugin of a logical replication slot, because output plugin paths were never subject to the LOAD-time restrictions that apply to library loading elsewhere - debian/patches/CVE-2026-6471.patch: add an output_plugin_libraries GUC defaulting to "pgoutput, test_decoding" in src/backend/utils/misc/guc.c, src/include/replication/logical.h and src/backend/utils/misc/postgresql.conf.sample, check the requested plugin name against that list in StartupDecodingContext() before calling LoadOutputPlugin() and reject anything else with "library ... may not be used as an output plugin" in src/backend/replication/logical/logical.c, quote the new list parameter correctly in src/bin/pg_dump/dumputils.c, document it in doc/src/sgml/config.sgml and doc/src/sgml/logical-replication.sgml and extend the tests in contrib/test_decoding and src/test/subscription/t/100_bugs.pl. Note that third-party output plugins other than pgoutput and test_decoding must now be added to output_plugin_libraries before they can be used - CVE-2026-6471 * SECURITY UPDATE: integer overflow in the Levenshtein distance functions, where any user could produce nonsensical results or, via levenshtein_less_equal(), trigger out-of-bounds writes, because levenshtein() and levenshtein_less_equal() accept arbitrary 32-bit insertion, deletion and substitution costs but computed the distance with 32-bit arithmetic - debian/patches/CVE-2026-15742.patch: widen the prev and curr row arrays and the per-operation costs to int64 and compute the distance in 64-bit arithmetic throughout varstr_levenshtein() in src/backend/utils/adt/levenshtein.c, add a levenshtein_result() helper in src/backend/utils/adt/varlena.c that raises ERRCODE_NUMERIC_VALUE_OUT_OF_RANGE with "levenshtein distance out of range" when the result does not fit in the returned int32, route every return through it, and cover the overflow cases in contrib/fuzzystrmatch/sql/fuzzystrmatch.sql and contrib/fuzzystrmatch/expected/fuzzystrmatch.out - CVE-2026-15742 * SECURITY UPDATE: type confusion via arguments and results of type internal, where any user could execute arbitrary code as the operating system user running the database by calling a function that takes or returns type internal, because type internal stands for a class of mutually incompatible data structures that are not meant to be reachable from SQL and the checks that were supposed to prevent such calls had gaps - debian/patches/CVE-2026-14680.patch: reject casting to or from type internal in can_coerce_type() and find_coercion_pathway() in src/backend/parser/parse_coerce.c, reject resolved argument and result types of internal in ParseFuncOrColumn() in src/backend/parser/parse_func.c and in make_op() in src/backend/parser/parse_oper.c, refuse the I/O coercion fallback for internal in get_cast_hashentry() in src/pl/plpgsql/src/pl_exec.c, and, as defence in depth, make numeric_combine(), numeric_avg_combine(), numeric_poly_combine() and int8_avg_combine() return a real SQL NULL instead of an unmarked null pointer in src/backend/utils/adt/numeric.c - CVE-2026-14680 * SECURITY UPDATE: type confusion between the outer and inner portal of an EXECUTE or FETCH statement, where any user could disclose server memory contents and execute arbitrary code as the operating system user running the database, because nothing checked that the portal created for the EXECUTE or FETCH statement and the portal for the statement being run on its behalf agreed on the tuple descriptor of the rows being returned - debian/patches/CVE-2026-16239.patch: extend the tuplestore DestReceiver with an optional target tuple descriptor and mapping failure message in src/include/executor/tstoreReceiver.h and src/backend/executor/tstoreReceiver.c, so that it builds a conversion map with convert_tuples_by_position() and raises an error when the executor output does not match, update the caller in PersistHoldablePortal() in src/backend/commands/portalcmds.c, and pass portal->tupDesc together with "query result type does not match portal result type" from FillPortalStore() in src/backend/tcop/pquery.c - CVE-2026-16239