* SECURITY UPDATE: SQL injection in psql where in-line COPY ... FROM STDIN data was executed as SQL commands when the COPY command failed or was skipped inside an \if branch - debian/patches/CVE-2026-6464.patch: teach the lexer to recognize and count COPY ... FROM STDIN commands via copy_stdin_count and psqlscan_is_copy_from_stdin(), save and restore the full lexer state when skipping \if branches, and make SendQuery() read and discard the pending COPY data through handleCopyIn() with a NULL connection, in src/bin/psql/command.c, common.c, copy.c, mainloop.c, startup.c, psqlscanslash.l, src/fe_utils/conditional.c and psqlscan.l - CVE-2026-6464 * SECURITY UPDATE: out of bounds reads in the ascii() function on invalid multibyte input, able to disclose bytes of server memory or trigger assertion failures - debian/patches/CVE-2026-18024.patch: validate the multibyte sequence length against the input length and replace the byte range assertions with ERRCODE_CHARACTER_NOT_IN_REPERTOIRE errors, in ascii() in src/backend/utils/adt/oracle_compat.c - CVE-2026-18024 * SECURITY UPDATE: stale cached plans kept enforcing outdated row level security policies after role membership or role attribute changes - debian/patches/CVE-2026-14666.patch: register syscache invalidation callbacks on pg_auth_members and pg_authid that invalidate the role dependent cached plans, in PlanCacheRoleCallback() and InitPlanCache() in src/backend/utils/cache/plancache.c - CVE-2026-14666 * SECURITY UPDATE: pgcrypto PGP encryption silently produced effectively unencrypted output when OpenSSL rejected the cipher, for example in FIPS mode, because the px_cipher_encrypt() result was never checked and the plaintext was XORed with a non encrypted block - debian/patches/CVE-2026-14663.patch: raise an error when the cipher fails during PGP processing and add the decrypt only ignore-cipher-failure option to recover data from badly encrypted messages, in contrib/pgcrypto/pgp-cfb.c, pgp-decrypt.c, pgp-encrypt.c, pgp-pgsql.c, pgp-pubkey.c, pgp.c and pgp.h - CVE-2026-14663 * SECURITY UPDATE: out of bounds writes in ecpg client programs processing bytea data from a rogue server that lacks the expected hex prefix - debian/patches/CVE-2026-16241.patch: reject bytea values shorter than two bytes or missing the \x prefix with a new ECPG_BYTEA_FORMAT error before computing decode sizes, in ecpg_get_data() in src/interfaces/ecpg/ecpglib/data.c, error.c and src/interfaces/ecpg/include/ecpgerrno.h - CVE-2026-16241