Reject calls from SQL to functions that take or return type internal. Allowing that is a security hole, since there are many different functions with different ideas of what their "internal" argument or result is. We already had a defense against the easy case of "'foo'::internal", but that turns out to be insufficient. Lock down both function and operator syntax. Also disallow attempts to cast to or from type internal; those would mostly fail anyway, but we have created some holes with features such as CoerceViaIO.
Reported-by: Amy Burnett (OpenAI Codex Security) Author: Tom Lane <[email protected]> Reviewed-by: Robert Haas <[email protected]> Backpatch-through: 14 Security: CVE-2026-14680 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/21a00de43b3d887a72d79ac91407baa284070ed2 Author: Tom Lane <[email protected]> Modified Files -------------- src/backend/parser/parse_coerce.c | 8 ++++++++ src/backend/parser/parse_func.c | 26 ++++++++++++++++++++++++++ src/backend/parser/parse_oper.c | 22 ++++++++++++++++++++++ src/pl/plpgsql/src/pl_exec.c | 12 ++++++++++-- 4 files changed, 66 insertions(+), 2 deletions(-)
