* SECURITY UPDATE: Memory disclosure via ctid selectivity estimation - debian/patches/CVE-2026-14668.patch: in scalarineqsel() only take the ctid block-number shortcut when the constant really is of type tid, so a non-ctid constant is no longer read as an ItemPointer - CVE-2026-14668 * SECURITY UPDATE: Heap buffer overflow in PL/Perl with tied hashes - debian/patches/CVE-2026-14670.patch: stop trusting the element count reported by tied Perl arrays and hashes, growing the target arrays as elements are actually fetched in plperl and hstore_plperl; bound the SETOF arrayref loop with av_count() instead of waiting for av_fetch() to return NULL, and treat a NULL SV pointer returned by hv_iternext() or av_fetch() as undef in plperl, hstore_plperl and jsonb_plperl (upstream follow-ups ede3188e11 and ec24237a40) - CVE-2026-14670 * SECURITY UPDATE: Type confusion in contrib/refint - debian/patches/CVE-2026-14671.patch: remove refint's per-backend plan cache and prepare the check queries on every call, so a stale or mismatched cached plan can no longer be executed - CVE-2026-14671 * SECURITY UPDATE: Integer wraparound in tsvector and tsquery - debian/patches/CVE-2026-14662.patch: check the sizes computed while building tsvector and tsquery values against their maximum lengths before allocating, so large inputs cannot undersize the buffers - CVE-2026-14662 * SECURITY UPDATE: Heap buffer overflow in regexp match/split - debian/patches/CVE-2026-14664.patch: size the regexp match and split result buffers for the actual data length after the pg_wchar round trip instead of assuming it cannot grow - CVE-2026-14664