* SECURITY UPDATE: server crash or disclosure of server memory via improperly validated oidvector and int2vector input values - debian/patches/CVE-2026-2003.patch: add check_valid_oidvector() and check_valid_int2vector() validators and call them from the hash, btree comparison and output functions of the two types, in src/backend/access/hash/hashfunc.c, src/backend/access/nbtree/nbtcompare.c, src/backend/utils/adt/format_type.c, int.c, oid.c and src/include/utils/builtins.h - CVE-2026-2003 * SECURITY UPDATE: memory disclosure or arbitrary code execution via selectivity estimator functions attached to operators with mismatched operand types - debian/patches/CVE-2026-2004.patch: require superuser to attach a non-built-in restriction or join estimator to an operator and verify the operand types of tsmatchsel(), networksel() and the intarray _int_matchsel() at run time, adding a get_function_sibling_type() helper backed by a new pg_extension.oid syscache, in src/backend/commands/operatorcmds.c, extension.c, src/backend/tsearch/ts_selfuncs.c, src/backend/utils/adt/network_selfuncs.c, src/backend/utils/cache/syscache.c, src/backend/catalog/pg_depend.c and contrib/intarray/_int_selfuncs.c - CVE-2026-2004 * SECURITY UPDATE: heap buffer overflow in pgcrypto public key decryption via an oversized session key in a crafted OpenPGP message - debian/patches/CVE-2026-2005.patch: validate the session key length against PGP_MAX_KEY in pgp_parse_pubenc_sesskey() and fail with the new PXE_PGP_KEY_TOO_BIG error instead of overflowing the context buffer, in contrib/pgcrypto/pgp-pubdec.c, px.c and px.h, with a new pgp-pubkey-session regression test - CVE-2026-2005 * SECURITY UPDATE: buffer overread in multibyte character processing via invalidly encoded or truncated strings reaching pg_mblen() callers - debian/patches/CVE-2026-2006.patch: introduce bounds-aware pg_mblen_cstr(), pg_mblen_range() and pg_mblen_with_len() and switch pg_mblen() call sites over to them, fix mb2wchar conversion of short input and the EUC_CN maximum character length, require PGP-decrypted text to pass encoding validation, and stop text_substring() from reading past a truncated multibyte character, in src/backend/utils/mb/mbutils.c, wchar.c, src/include/mb/pg_wchar.h, src/backend/utils/adt/varlena.c, json.c, regexp.c, src/backend/parser/scan.l, contrib/pgcrypto/pgp-pgsql.c, the tsearch parsers and the btree_gist, dict_xsyn, ltree, pg_trgm and unaccent contrib modules - CVE-2026-2006