CVE-2026-14671

A type confusion vulnerability in PostgreSQL's refint (reference integrity) contrib module allowed arbitrary code execution through stale plan cache type bindings that survived schema changes. The fix was committed as a routine development patch that removed the optimization entirely, rather than patching the specific vulnerability. No CVE was assigned, no security announcement was made, and no automated feed update propagated the remediation to system administrators. This is not a one-off oversight—it exposes a structural gap in how PostgreSQL handles security-relevant changes in its contrib modules. The refint module lives in contrib/, not core PostgreSQL, and operates under different maintenance assumptions: fewer eyeballs, less security triage, and no formalized process to flag contrib bug reports for security review before commit. When a contributor files a bug against contrib, there's no equivalent [email protected] pathway that triggers the same scrutiny core patches receive. The operational consequence is identical regardless of intent: thousands of PostgreSQL deployments have no standardized mechanism to learn they need to update refint. Security scanners, CVE feeds, and vulnerability management tooling never received a signal because none was generated. The fix exists—the commit 'refint: Remove plan cache' is in the repository—but the exposure window for systems that haven't pulled recent updates is invisible to normal remediation workflows. If you're running PostgreSQL, audit your deployment specifically for refint usage. Check whether you're on a version that includes the plan cache removal (the commit that eliminated the optimization entirely). If you rely on refint for legacy referential integrity enforcement, verify your PostgreSQL version includes the fix—or consider migrating to native declarative constraints if your version supports them, since refint itself is a legacy module with shrinking active maintenance. The absence of a CVE means traditional vulnerability management will not alert you to this exposure; you must actively check your PostgreSQL release notes and git history for contrib module changes rather than relying on CVE feeds alone.

Reviewed through automated stages and approved by a human before publication.