* SECURITY UPDATE: Out-of-bounds read in ascii() on invalid multibyte input - debian/patches/CVE-2026-18024.patch: check that the input string is long enough for the character length implied by its first byte, and replace the byte-range assertions with error reports - CVE-2026-18024 * SECURITY UPDATE: Row-level security bypass via stale cached plans - debian/patches/CVE-2026-14666.patch: register syscache callbacks on pg_authid and pg_auth_members that invalidate role-dependent cached plans after role membership or attribute changes (the pg_database callback is omitted: pg_database_owner does not exist in 13) - CVE-2026-14666 * SECURITY UPDATE: PGP encryption silently disabled on cipher failure - debian/patches/CVE-2026-14663.patch: check the result of px_cipher_encrypt() in the pgcrypto PGP CFB code and raise an error when OpenSSL cannot initialise the cipher, instead of emitting unencrypted data; add the ignore-cipher-failure decryption option to recover messages written by the faulty path (upstream follow-up e2c48c81fc) - CVE-2026-14663 * SECURITY UPDATE: Out-of-bounds read in pg_trgm GiST picksplit - debian/patches/CVE-2026-14678.patch: in gtrgm_picksplit() pass the cached BITVECP signature directly instead of through GETSIGN(), which read beyond the end of the buffer - CVE-2026-14678 * SECURITY UPDATE: Out-of-bounds write in ECPG bytea decoding - debian/patches/CVE-2026-16241.patch: in ecpg_get_data() reject bytea data from the server that does not start with "\x", with a new ECPG_BYTEA_FORMAT error, instead of decoding it past the buffer - CVE-2026-16241