postgres-github.git / summary / log / commit / refs

commit    260e97733bf09acc448faea24fc6210411892b1a
Author:   Nathan Bossart <nathan@postgresql.org>
Commit:   Noah Misch <noah@leadboat.com>
Date:     Mon May 11 12:13:47 2026 +0000

    refint: Fix SQL injection and buffer overruns.
    
    Maliciously crafted key value updates could achieve SQL injection
    within check_foreign_key().  To fix, ensure new key values are
    properly quoted and escaped in the internally generated SQL
    statements.  While at it, avoid potential buffer overruns by
    replacing the stack buffers for internally generated SQL statements
    with StringInfo.
    
    Reported-by: Nikolay Samokhvalov <nik@postgres.ai>
    Author: Nathan Bossart <nathandbossart@gmail.com>
    Reviewed-by: Noah Misch <noah@leadboat.com>
    Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
    Reviewed-by: Fujii Masao <masao.fujii@gmail.com>
    Security: CVE-2026-6637
    Backpatch-through: 14

[parent: bd48114937c8]