Prevent unbounded recursion while processing startup packets.

Fix assorted integer overflows in memory-allocation calculations.

Reject over-length options in ts_headline().

Guard against malicious time zone names in timeofday() and pg_strftime().

When creating a multirange type, ensure the user has CREATE privilege on the schema specified for the multirange type.

Use timing-safe string comparisons in authentication code.

Mark PQfn() as unsafe, and avoid using it within libpq.

Prevent path traversal in pg_basebackup and pg_rewind.

Guard against field overflow within contrib/intarray’s query_int type and contrib/ltree’s ltxtquery type.

Prevent SQL injection and buffer overruns in contrib/spi. For further details, visit PostgreSQL’s release notes.