* SECURITY UPDATE: Server memory disclosure via crafted oidvector/int2vector - debian/patches/CVE-2026-2003.patch: add check_valid_oidvector() and check_valid_int2vector() and call them from hashoidvector(), hashoidvectorextended(), btoidvectorcmp(), oidvectortypes(), int2vectorout() and oidvectorout(), so an oid[] or int2[] array cast to these types cannot violate the 1-dimensional, no-nulls layout those functions assume - CVE-2026-2003 * SECURITY UPDATE: Arbitrary code execution via intarray selectivity estimator - debian/patches/CVE-2026-2004.patch: require superuser to attach a non-built-in restriction or join selectivity estimator, reject a wrong-typed Const in _int_matchsel() via get_function_sibling_type(), turn the tsmatchsel() Assert into a runtime vartype check and validate the operator up front in networksel()/networkjoinsel() - CVE-2026-2004 * SECURITY UPDATE: Heap buffer overflow in pgcrypto public-key decryption - debian/patches/CVE-2026-2005.patch: bounds-check the session key length against PGP_MAX_KEY in pgp_parse_pubenc_sesskey() before the memcpy() into ctx->sess_key, and add the PXE_PGP_KEY_TOO_BIG error - CVE-2026-2005 * SECURITY UPDATE: Buffer overrun via crafted multibyte characters - debian/patches/CVE-2026-2006.patch: replace pg_mblen() with the bounds-checked pg_mblen_cstr()/_with_len()/_range()/_unbounded() variants across all callers, fix the EUC_CN encoding length for SS2/SS3 lead bytes, guard the mb2wchar conversions on short input and require PGP-decrypted text to pass encoding validation; also take the upstream follow-up that keeps SUBSTRING() working on toasted multibyte values, by counting characters with the new pg_mbcharcliplen_chars() helper that stops at the substring end instead of running pg_mbstrlen_with_len() over the whole conservative detoast slice, whose tail is routinely a partial character - CVE-2026-2006