public inbox for [email protected]  

help / color / mirror / Atom feed
From: Gianfranco Cocco <[email protected]>
To: [email protected] <[email protected]>
Subject: Clarification on CVE 2026 impact for PostgreSQL 17.x with Citus, TimescaleDB and PostGIS
Date: Fri, 20 Feb 2026 15:00:19 +0000
Message-ID: <DB3PR0202MB913102250F4B5B9826802718F468A@DB3PR0202MB9131.eurprd02.prod.outlook.com> (raw)
In-Reply-To: <PAVPR02MB9134B7CC491B23B7AE1594C5F46BA@PAVPR02MB9134.eurprd02.prod.outlook.com>
References: <PAVPR02MB91341DC185505DE6077B3A90F46AA@PAVPR02MB9134.eurprd02.prod.outlook.com>
	<PAVPR02MB9134B7CC491B23B7AE1594C5F46BA@PAVPR02MB9134.eurprd02.prod.outlook.com>


Dear PostgreSQL Team,

We are currently running a production environment based on PostgreSQL 17.x with the following extensions:

Citus 13.2
TimescaleDB
PostGIS

Following the recent disclosure of CVEs for 2026 affecting PostgreSQL, we would appreciate clarification on the following points:

If the vulnerability affects the PostgreSQL core binaries only, is upgrading to the latest 17.x minor release sufficient to mitigate the issue?

Are there any known implications for extensions such as Citus, TimescaleDB, or PostGIS when upgrading PostgreSQL minor versions to address security fixes?

In your experience, are there scenarios where rebuilding or explicitly upgrading extensions (via ALTER EXTENSION UPDATE) is required after applying a security-related minor upgrade?

Are there known compatibility considerations for distributed environments (Citus) or time-series workloads (TimescaleDB) in the context of these CVEs?

We aim to minimize downtime while ensuring full mitigation of the reported vulnerabilities, and we would appreciate any guidance or best practices you can share.

Thank you for your time and for your continuous work on PostgreSQL security.

Best regards,


Gian




Gianfranco Cocco
Infrastructure Database Administration


[cid:d43a3107-cf26-49dd-b6ef-3828039a4e07]<https://www.vargroup.com/;

vargroup.com



[Immagine]<https://www.greatplacetowork.it/scheda_azienda/var-group/;

Questo messaggio รจ stato spedito da Var Group S.p.A. o da una delle aziende del Gruppo. Esso, e gli eventuali allegati, potrebbero contenere informazioni di carattere estremamente riservato e confidenziale. Qualora non foste i destinatari designati, vogliate cortesemente informarci immediatamente con lo stesso mezzo ed eliminare il messaggio e i relativi eventuali allegati, senza trattenerne copia.



Attachments:

  [image/png] Outlook-ognqwcwc.png (9.1K, 3-Outlook-ognqwcwc.png)
  download | view image

  [image/jpeg] Outlook-Immagine.jpg (1.8K, 4-Outlook-Immagine.jpg)
  download | view image

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Clarification on CVE 2026 impact for PostgreSQL 17.x with Citus, TimescaleDB and PostGIS
  In-Reply-To: <DB3PR0202MB913102250F4B5B9826802718F468A@DB3PR0202MB9131.eurprd02.prod.outlook.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox