This SUSE security update for PostgreSQL 14 upgrades the software to version 14.23, resolving eight security vulnerabilities: CVE-2026-6472 ensures users have CREATE privilege on schemas; CVE-2026-6473 fixes integer overflows in memory allocation; CVE-2026-6474 guards against malicious time zone names; CVE-2026-6475 prevents path traversal in pg_basebackup and pg_rewind; CVE-2026-6477 marks PQfn() as unsafe and avoids its use in libpq; CVE-2026-6478 implements timing-safe string comparisons in authentication; CVE-2026-6479 prevents unbounded recursion in startup packet processing; and CVE-2026-6637 prevents SQL injection and buffer overruns in contrib/spi. The update is specific to SUSE PostgreSQL 14 packages on aarch64 architecture.

The vulnerabilities collectively could allow unauthorized schema creation, memory corruption via integer overflows, exploitation through crafted time zone names, directory traversal attacks, unsafe function calls leading to potential instability or exploitation, timing attacks on authentication, denial of service via recursion, and SQL injection with buffer overruns. These issues pose a high security risk to affected PostgreSQL 14 installations on SUSE systems if unpatched. No known exploits in the wild have been reported at this time.

An official security update to PostgreSQL 14 version 14.23 is available from the SUSE Product Security Team. Applying this update will remediate all listed vulnerabilities. Users should upgrade affected PostgreSQL 14 packages on SUSE systems to this fixed version promptly. No additional mitigation steps are indicated beyond applying the official patch.