--- title: "PostgreSQL 18 patches 11 CVEs, Cloudflare traces a ClickHouse mutex to a billing outage" url: https://daily.dev/posts/postgresql-18-patches-11-cves-cloudflare-traces-a-clickhouse-mutex-to-a-billing-outage-65ahlayjh source_url: https://daily.dev/posts/postgresql-18-patches-11-cves-cloudflare-traces-a-clickhouse-mutex-to-a-billing-outage-65ahlayjh type: freeform source: "Databases Digest" published: 2026-05-15T04:18:37.667Z updated: 2026-05-15T04:18:55.464Z tags: ["security", "backend", "postgresql", "clickhouse", "apache-kafka"] reading_time: 5 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PostgreSQL 18 patches 11 CVEs, Cloudflare traces a ClickHouse mutex to a billing outage **[Databases Digest](https://daily.dev/sources/databases_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary PostgreSQL released security updates across all supported versions (14–18) patching 11 CVEs, several at CVSS 8.8, covering SQL injection, integer wraparound, symlink following, stack buffer overflow, and timing channel vulnerabilities. Cloudflare published a postmortem on a ClickHouse billing pipeline slowdown traced to a single mutex contention bug (MergeTreeData) invisible to standard metrics, fixed via shared locks, deferred vector copy, and binary search — cutting query durations by 50%. Confluent added Kafka observability metrics including client throttle visibility and rebalance tracking. Databricks expanded Unity Catalog Open APIs to let Flink, DuckDB, and Spark write to managed Delta tables with credential vending now GA. Additional items cover PostgreSQL 19 preview features, Confluent Tableflow for Kafka-to-Iceberg/Delta conversion, Wix's zero-downtime MySQL migration tooling, Weaviate v1.37 tokenization endpoint, VictoriaLogs performance claims, and Prometheus 3.0 Remote Write 2.0. ## Content **TLDR:** PostgreSQL dropped security updates across all supported versions today, patching 11 vulnerabilities including several at CVSS 8.8. Cloudflare published a detailed postmortem on a ClickHouse billing pipeline slowdown caused by a single mutex contention bug that standard metrics completely missed. Confluent shipped new Kafka observability metrics that collapse multi-hour throttling debug loops into a single query. Databricks expanded Unity Catalog's Open APIs to let external engines like Flink and DuckDB write to managed Delta tables. --- ## PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 released The PostgreSQL Global Development Group patched 11 security vulnerabilities today across all supported branches. Several carry CVSS scores of 8.8, covering missing authorization in CREATE TYPE that allows arbitrary SQL execution, integer wraparound causing out-of-bounds writes, symlink following in pg_basebackup and pg_rewind, SQL injection in pg_createsubscriber and REFRESH PUBLICATION, and a stack buffer overflow in the refint module. There are also fixes for libpq lo_* functions that let a server superuser overwrite client stack memory, a timing channel in MD5 password comparison, and uncontrolled recursion in SSL/GSS negotiation. Over 60 additional bugs are fixed across the release. PostgreSQL 14 reaches end-of-life on November 12, 2026 — if you're still on it, that clock is ticking. ## Cloudflare's billing pipeline and a hidden ClickHouse mutex This is a good one. Cloudflare's billing pipeline started missing daily deadlines after they changed a ClickHouse table's partitioning key from (day) to (namespace, day) for per-tenant retention. Standard metrics — I/O, memory, parts read per query — all looked normal. Using ClickHouse's trace_log and flame graphs, engineers found that over half of query duration was spent waiting on a single exclusive mutex (MergeTreeData) that every query planner thread had to acquire to copy the full parts list. Three fixes landed in sequence: switching to a shared lock, deferring the full vector copy with a shared cache, and replacing a linear scan over all parts with a binary search on the namespace partition key. The result was a 50% cut in query durations and the correlation between part count and latency was broken entirely. The fixes are merged into ClickHouse 25.11. ## Confluent Cloud adds Kafka observability metrics that actually help Confluent shipped several new metrics to its Kafka Metrics API. The one worth paying attention to immediately is client_limit_milliseconds, which tells you which principals are being throttled and why — previously that required hours of log spelunking. There's also max_pending_rebalance_time_milliseconds for tracking consumer group rebalance duration directly, and connection_accept_count to correlate connection storms with elastic cluster scaling events. An upcoming cleanup.policy dimension on partition_count will let you differentiate compacted partitions from regular ones. The Cluster Monitoring page in the console also gets an eCKU usage chart showing which dimensions are driving capacity consumption. ## Databricks expands Unity Catalog Open APIs for external engines External engines — Spark, Flink, DuckDB — can now create and write to Unity Catalog managed Delta tables in Beta, with centralized governance and automatic optimizations like Predictive Optimization and Liquid Clustering applied on top. Credential vending is now generally available, replacing long-lived personal access tokens with short-lived, scoped cloud storage credentials via M2M OAuth. Volume credential vending for unstructured data (images, PDFs, videos) is in Public Preview. Delta Kernel in Java and Rust abstracts the low-level Delta protocol details to simplify connector development. Attribute-based access controls for fine-grained row and column level policies on external reads are still in development. --- ## Also notable - **PostgreSQL 19: GROUP BY ALL** automatically infers grouping columns from the SELECT list, IGNORE NULLS and RESPECT NULLS land on five window functions, and EXPLAIN output for Memoize nodes now includes planner estimates for cache capacity and hit percent. - **PostgreSQL 19: logical replication** gets sequence synchronization between publisher and subscriber, an EXCEPT TABLE clause for FOR ALL TABLES publications, and dynamic WAL level via effective_wal_level — no more manual config and server restarts to toggle logical replication. - **PostgreSQL 19: COPY TO FORMAT JSON** exports data as NDJSON or JSON array natively, replacing the row_to_json() and json_agg() workarounds that either added escaping noise or loaded full result sets into memory. - **Confluent Tableflow** converts Kafka topics directly into Iceberg and Delta Lake tables by reusing Kafka segments stored in the Kora engine, claiming 30-50% lower ingestion costs versus Snowpipe, Delta Live Tables, and custom ETL stacks; a medium-throughput example (10 topics, 1 MBps, 7-day retention) shows $2,555/month versus $5,063-$6,075 with traditional pipelines. - **Wix DB Mover** is an internal Python microservice for zero-downtime MySQL cluster migrations using Debezium CDC, Amazon MSK with Avro serialization, and a staged cutover process — application teams need zero code changes. - **Weaviate v1.37** adds a /v1/tokenize REST endpoint that shows exactly what tokens are written to the inverted index versus what BM25 scores at query time, plus per-property stopword presets and accent folding for multilingual Latin-script matching. - **Elastic production RAG lessons** from over one million messages: partial context retrieval (tangentially relevant documents) scores 8.15/10 versus 9.18/10 for returning no context at all — retrieval confidence thresholds matter more than LLM selection. - **Ardent** creates isolated copy-on-write Postgres branches in under 6 seconds for AI coding agents to run migrations and data operations against exact production replicas. - **VictoriaLogs** claims up to 30x less RAM and 15x less disk than Elasticsearch or Grafana Loki, with LogsQL, multitenancy, and both single-node and cluster deployments. - **SQL Server 2016 end-of-support** hits July 15, 2026; Microsoft is offering a free migration service (Cloud Accelerate Factory) covering database, application, and analytics workload migrations to Azure SQL or newer on-premises versions. - **Prometheus 3.0** (released November 2024) brings Remote Write 2.0 with 60% fewer bytes and 90% fewer allocations via string interning, native OTLP ingestion, and UTF-8 metric names — migration requires stepping through v2.55 first due to TSDB index format changes. - **Computer + Snowflake integration** lets the AI tool run end-to-end SQL analysis against live warehouse data, applying filters and working with source tables and metrics directly. --- Tags: [#security](https://daily.dev/tags/security), [#backend](https://daily.dev/tags/backend), [#postgresql](https://daily.dev/tags/postgresql), [#clickhouse](https://daily.dev/tags/clickhouse), [#apache-kafka](https://daily.dev/tags/apache-kafka) [View this post on daily.dev](https://daily.dev/posts/postgresql-18-patches-11-cves-cloudflare-traces-a-clickhouse-mutex-to-a-billing-outage-65ahlayjh)