* SECURITY UPDATE: out-of-bounds reads and backend crashes via oidvector and int2vector values with unexpected array dimensions, reachable because a general oid[] or int2[] array can be cast to the vector type - debian/patches/CVE-2026-2003.patch: add check_valid_oidvector() and check_valid_int2vector() validators that reject arrays whose ndim, dataoffset or elemtype violate the vector type's restrictions, and call them before reading dim1 in the hashing, btree comparison, input and format_type paths in src/backend/access/hash/hashfunc.c, src/backend/access/nbtree/nbtcompare.c, src/backend/utils/adt/format_type.c, src/backend/utils/adt/int.c, src/backend/utils/adt/oid.c and src/include/utils/builtins.h - CVE-2026-2003 * SECURITY UPDATE: a non-superuser can install an arbitrary function as an operator's restriction or join selectivity estimator, and built-in estimators can be attached to an operator of the wrong type - debian/patches/CVE-2026-2004.patch: require superuser to specify a non-built-in restriction or join selectivity estimator in CREATE OPERATOR while requiring only EXECUTE rights for built-in ones, add get_function_sibling_type() and harden the intarray, tsearch and network selectivity estimators against being attached to the wrong operator, and backport the upstream pg_extension.oid syscache (EXTENSIONOID) that PostgreSQL 11 lacks, in contrib/intarray/_int_selfuncs.c, src/backend/commands/operatorcmds.c, src/backend/commands/extension.c, src/backend/catalog/pg_depend.c, src/backend/tsearch/ts_selfuncs.c, src/backend/utils/adt/network_selfuncs.c, src/backend/utils/cache/syscache.c and their headers - CVE-2026-2004 * SECURITY UPDATE: buffer overflow in pgp_pub_decrypt_bytea() in pgcrypto when the PGP session key is longer than the destination buffer - debian/patches/CVE-2026-2005.patch: bound the session key length against PGP_MAX_KEY before storing it in the decryption context and report the new PXE_PGP_KEY_TOO_BIG error instead of overrunning the buffer, in contrib/pgcrypto/pgp-pubdec.c, contrib/pgcrypto/px.c and contrib/pgcrypto/px.h - CVE-2026-2005 * SECURITY UPDATE: out-of-bounds reads when measuring truncated or invalid multibyte characters, an understated maximum character length for EUC_CN, and missing encoding validation of PGP-decrypted text - debian/patches/CVE-2026-2006.patch: replace the unbounded pg_mblen() with the bounds-checked pg_mblen_with_len(), pg_mblen_range() and pg_mblen_unbounded() variants throughout the backend, tsearch, ltree, pg_trgm, btree_gist, unaccent and dict_xsyn code, make the mb2wchar conversion functions tolerate short input, raise the EUC_CN maximum character length from 2 to 3 so SS2 and SS3 sequences are measured correctly in src/backend/utils/mb/wchar.c, and require PGP-decrypted text to pass pg_verifymbstr() encoding validation in contrib/pgcrypto/pgp-pgsql.c - CVE-2026-2006