Shared knowledge about PostgreSQL — tuning, performance, architecture and database administration.
CVE-2026-6478: Timing Channel in PostgreSQL MD5 Passwords
On May 14, 2026, PostgreSQL released security fixes for versions 18.4, 17.10, 16.14, 15.18, and 14.23. Among the vulnerabilities fixed is CVE-2026-6478, described by the project as a timing side channel in MD5 password comparison during authentication. ...
Knowledge that doesn't get lost on disk
In PostgreSQL, shared_buffers is the parameter that defines the size of the buffer pool — the memory area where data pages are kept warm so queries don’t need to hit the disk on every access. When a page is in the buffer, it’s immediately available to any database process. That’s the point: shared memory that speeds everything up. This blog’s name comes from that, but the metaphor goes a bit further than the parameter. ...