Database Technology

Amazon RDS has released PostgreSQL 19 Release Candidate 1 (RC1) in the Database Preview Environment, allowing users to evaluate the pre-release version. This build focuses on stability, incorporating bug fixes and improvements identified during the Beta 4 testing phase. Key technical updates include enhanced error handling for complex text-search expressions, hardened parallel autovacuum processes, and improved reliability for GIN index maintenance. Instances in this preview environment are retained for a maximum of 60 days before automatic deletion.

• Evaluate PostgreSQL 19 stability and new features in a controlled RDS preview environment.
• Check complex text-search logic for improved error handling and behavior changes.
• Monitor parallel autovacuum performance and GIN index maintenance reliability.
• Plan for instance deletion after 60 days; use snapshots for backup if needed.

PgBouncer 1.26.1 addresses three critical vulnerabilities, most notably CVE-2026-107350 which allows authentication bypass for SCRAM users. The update also resolves two denial-of-service issues caused by infinite loops triggered by unauthenticated clients via malformed startup parameters and integer overflows. This release is essential for maintaining connection pool security and stability.

• CVE-2026-107350 fixes SCRAM auth bypass when connecting to non-existent databases
• CVE-2026-107349 resolves DoS from empty option names in startup parameters
• CVE-2026-107348 fixes DoS from integer overflow when max_packet_size exceeds default
• Unauthenticated clients can trigger DoS, so monitor for connection spikes
• Upgrade immediately to prevent potential privilege escalation to superuser

Setting primary_slot_name on a standby forces the upstream server to retain all WAL files indefinitely. This retention continues until the disk fills up or the standby connection is lost and the slot is not cleaned up. This behavior creates a significant risk of storage exhaustion if replication lag is not actively monitored.

• Upstream WAL retention is unbounded until disk is full or slot is removed.
• Monitor replication lag closely to prevent standby catch-up delays.
• Ensure standby connection stability to avoid orphaned replication slots.
• Implement automated cleanup policies for inactive or lagging slots.
• Watch disk usage on primary servers when using persistent replication slots.

The psqlODBC team released version 18.00.0005 to address CVE-2026-109448, a medium-severity vulnerability causing heap memory corruption. The flaw stems from storing bound parameter counts in a signed 16-bit field, which overflows when an application binds more than 32767 parameters. This overflow writes zeros outside the parameter binding memory, potentially crashing the application or corrupting data. All users of versions 08.01.0102 through 18.00.0004 are advised to upgrade immediately.

• Upgrade psqlODBC to 18.00.0005 to patch CVE-2026-109448 heap corruption
• Vulnerability triggers when binding >32767 parameters on a single statement
• Root cause is a signed 16-bit integer overflow for parameter count storage
• Risk is highest for apps using untrusted input to determine parameter count
• Affected versions range from 08.01.0102 up to 18.00.0004 inclusive

Devrim Gündüz has rebuilt bigquery_fdw packages for major RPM-based distributions, resolving a critical regression where Python modules failed to import within the extension's interpreter. The update covers RHEL 8/9/10, Fedora 43/44/45, Amazon Linux 2023, and SLES 15/16, restoring functionality to the foreign data wrapper. This fix addresses a long-standing packaging issue that had rendered the extension unusable for users relying on the official repositories. No user action is required beyond standard package updates to apply the corrected binaries.

• bigquery_fdw is fully restored on RHEL, Fedora, AL2023, and SLES RPM repos.
• Root cause was Python module import failures in the extension's embedded interpreter.
• Update packages via yum/zypper to apply the fix; no config changes needed.
• Affects all users relying on pre-built RPMs for BigQuery connectivity in PostgreSQL.
• Full technical details and history available in issue #367.