GoKawiilResearcher finds 22-year-old type-confusion bug in PostgreSQL core enabling RCE
A security researcher discovered a previously unknown memory-corruption vulnerability in PostgreSQL's core code, dating back 22 years, that can be triggered through type confusion in composite data types. The flaw was uncovered while investigating a separate exploit in the pg_clickhouse extension, and was developed into a reliable remote-code-execution exploit. The work is detailed in the third post of a series on systemic risks in managed PostgreSQL services.