OffNet Newsroom

Daily topic roundup

Database Technology

Monday, October 05, 2026 · 8 stories, curated & summarized — click any story for the source.

The pgvector 0.8.7 release addresses a critical buffer overflow vulnerability discovered during IVFFlat index construction. This flaw, tracked as CVE-2026-103484, poses a risk of arbitrary code execution. The extension provides vector similarity search capabilities for PostgreSQL.

  • Upgrade immediately to patch CVE-2026-103484, which allows arbitrary code execution via IVFFlat index builds.
  • This vulnerability specifically affects the construction phase of IVFFlat indexes in pgvector.
  • Review index creation logs for any signs of exploitation if upgrading is delayed.
  • pgvector remains the standard open-source extension for vector similarity search in Postgres.
CHECKLISTWhat matters hereUpgrade immediately to patch CVE-2026-103484, which allows arbitrary…This vulnerability specifically affects the construction phase of…Review index creation logs for any signs of exploitation if upgrading…pgvector remains the standard open-source extension for vector…

Long-running transactions holding row locks on thousands of parent rows can cause significant multixact cache misses. These cache misses directly degrade insert throughput in PostgreSQL workloads with heavy locking contention. The issue highlights the performance cost of multixact cache management under specific locking patterns.

  • Multixact cache misses severely impact insert throughput in PostgreSQL
  • Long transactions locking many parent rows trigger this performance issue
  • Monitor multixact cache hit ratios for workloads with high locking contention
  • Consider transaction design to minimize long-held row locks on many rows
The Register general

Reg hack tests if clever database can run Doom

A developer from The Register has ported the classic game Doom to a modern database system to demonstrate its computational capabilities. The experiment serves as a stress test for the database's ability to handle complex logic and execution outside standard query operations. This playful benchmark highlights the flexibility of the underlying engine while raising questions about practical utility versus novelty.

  • Database engines can execute arbitrary logic beyond SQL queries
  • Porting legacy code tests engine flexibility and performance
  • Novel benchmarks like Doom reveal edge-case capabilities
  • Practical production use cases remain distinct from gaming hacks

ClickHouse Managed Postgres enables Direct I/O for backups to prevent the Linux page cache from being evicted by large sequential reads. Without this flag, backup traffic displaces frequently used data from memory, forcing subsequent queries to hit slow disk storage. This approach preserves query performance but introduces a secondary issue where the loss of kernel readahead can degrade throughput on striped NVMe arrays.

  • Backup reads bypass the page cache, preventing eviction of active query data
  • Direct I/O avoids cache pollution but disables kernel-level readahead optimizations
  • Striped NVMe configurations may suffer performance penalties due to lost readahead
  • Managed services may handle this trade-off automatically for stability

Chris van Eijk benchmarks trigger-based audit logging in PostgreSQL 17, comparing row-level against statement-level triggers and full-row captures versus column-specific changes. The analysis includes the performance penalty of applying row-level security on the audit log table itself. Results quantify the exact cost of these design choices for multi-tenant isolation.

  • Row-level triggers incur higher per-row overhead than statement-level triggers.
  • Auditing full rows is more expensive than auditing only changed columns.
  • Row-level security on audit logs adds measurable latency to write paths.
  • PostgreSQL 17 provides the baseline for these specific trigger behaviors.
Hacker News (100+ points) general

Doom Ported to SQL via CedarDB for Procedural Logic Proof

A developer has successfully ported the original Doom engine to execute within a SQL database using CedarDB. This project demonstrates that complex procedural logic and game state management can be implemented entirely through database functions and stored procedures. The effort highlights the expressive power of modern SQL engines beyond simple data retrieval.

  • Procedural logic can be embedded directly in SQL, challenging the view of SQL as read-only.
  • CedarDB supports complex function execution, enabling non-trivial applications like games.
  • This serves as a technical proof-of-concept rather than a production-ready pattern.
  • Database engines are evolving to handle more sophisticated computational workloads.

A new paper introduces AptMQL-Bench, a benchmark for evaluating natural language interfaces to document databases like MongoDB. It highlights that current methods for converting Text-to-SQL benchmarks to Text-to-MQL rely on flawed heuristics that merely mirror relational schemas. These naive conversions result in significant data loss, with up to 25.9% of rows dropped, and fail to migrate entire databases in multiple cases.

  • Heuristic schema mirroring from SQL to MongoDB is insufficient for accurate benchmarking.
  • Existing conversion methods silently drop significant portions of source data.
  • AptMQL-Bench provides a rigorous standard for Text-to-MQL evaluation.
  • Developers should avoid simple foreign-key graph mappings for document stores.
BY THE NUMBERSData Loss in MQL Migration25.9%Rows dropped by heuristicsUp to 25.9% of rows lost in naive SQL-to-MQL conversion
AWS What's New awsdatabase ↺ since 10-01

Aurora PostgreSQL now queries Iceberg and Parquet via foreign tables

Amazon Aurora PostgreSQL now supports direct querying of Apache Iceberg and Parquet files stored in S3, S3 Tables, or the AWS Glue Data Catalog. This capability eliminates the need for ETL pipelines to copy data into the database by allowing applications to access lake data through standard PostgreSQL foreign tables. The feature integrates operational and analytical data access without duplicating datasets or refactoring existing SQL tools.

  • Query Iceberg/Parquet in S3 directly via PostgreSQL foreign tables
  • Remove ETL pipelines and data duplication for analytics workloads
  • Use existing PostgreSQL clients without schema migration effort
  • Supports S3, S3 Tables, and AWS Glue Data Catalog sources
HOW IT WORKSDirect Lake Querying Pipeline1Store data in S32Catalog in Glue3Query via Foreign Tables4Access in PostgreSQL
↑