pg_vault_tde 1.7.2 fixes encrypted PostgreSQL corruption — but upgrades require table rewrites

Maintainer Miriade announced pg_vault_tde 1.7.2 on October 5, 2026. It addresses crashes involving indexed variable-length columns and encrypted TOAST values, a case in which an all-NULL row could make a table unreadable, and incorrect answers from the tde_btree index on range, ORDER BY and merge-join operations. It also addresses data loss and corruption bugs around online key rotation, wallet KEK rotation and vault-to-wallet migrations. A new v5 on-disk tuple format and a WAL resource-manager ID change impose mandatory upgrade steps. The extension SQL version stays at 1.7, while pg_vault_tde_build_version() distinguishes the binary patch.

For operators encrypting database content with this extension, the release is simultaneously an urgent correctness fix and a planned-maintenance event. The vendor warns that old v4 rows remain readable but can crash on UPDATE after installing the patch, so merely replacing the binary is insufficient. VACUUM FULL rewrites every encrypted table into the v5 layout, with potential lock, disk-space and downtime implications. The WAL ID change also rules out a rolling upgrade for clusters with toast_custom_rmgr enabled. This is not a PostgreSQL core flaw or a general PostgreSQL encryption feature; it affects users of this specific extension.

The release fixes segfaults during UPDATE of indexed variable-length encrypted columns and on TOAST threshold crossings. It also prevents tde_btree from answering unsupported range and ordering operations that previously could return incorrect rows, and addresses corruption/data-loss paths in key rotation and migrations. The vendor does not describe active exploitation; these are documented defects in the extension.

After installing 1.7.2, the vendor instructs operators to run VACUUM FULL on every encrypted table. Without rewriting old v4-format rows to v5, UPDATE can still crash. VACUUM FULL is a heavy rewrite operation; assess locks, extra disk headroom, replication and backup/restore windows before scheduling it.

The WAL resource-manager ID changes from 128 to registered ID 161. A clean shutdown is required, and when toast_custom_rmgr is enabled primary and standby servers must be upgraded together. Rolling upgrades in that configuration are explicitly unsupported.

The extension version number reported at the SQL layer remains 1.7 for this binary patch. The new pg_vault_tde_build_version() function distinguishes builds, so inventory tools should not rely solely on the extension's SQL version.