PostgreSQL Fix Impact & Severity
1.4
k
Distinct fixes profiled
80
CVE fixes with CVSS severity
4
with a public bug-report latency
55
Median line churn, CVE fixes
30
median churn, everything else
349
Fixes with a linked report-to-fix latency
Distinct CVE-bearing fixes per base-score band (postgresql.org/support/security)
Security Fixes by CVSS V3 Severity
Distinct CVE-bearing fixes per base-score band (postgresql.org/support/security)
HIGH
LOW
MEDIUM
LOW
MEDIUM
HIGH
0
20
40
Median line churn (added + deleted) of the representative commit; higher-severity CVEs are not necessarily larger changes
Fix Size by Severity
Median line churn (added + deleted) of the representative commit; higher-severity CVEs are not necessarily larger changes
HIGH
LOW
MEDIUM
LOW
MEDIUM
HIGH
0
20
40
60
Median number of stable branches a fix landed on, by severity band — 'inclusion across releases'
Backpatch Breadth by Severity
Median number of stable branches a fix landed on, by severity band — 'inclusion across releases'
HIGH
LOW
MEDIUM
LOW
MEDIUM
HIGH
0
2
4
Median report-to-fix latency per size bucket (bug-linked fixes) — does a bigger change take longer to land?
Time to Fix by Change Size
Median report-to-fix latency per size bucket (bug-linked fixes) — does a bigger change take longer to land?
small (<20 lines)
medium (20-99)
large (100+)
0
2
4
6
Each bug-linked fix: line churn (x, log) vs report-to-fix days (y, symlog so same-day fixes still show). The power-law fit is nearly flat — size explains ~0.7% of the variance (R² = 0.007), so bigger changes don't take longer to land.
Fix Size vs Time to Fix
Each bug-linked fix: line churn (x, log) vs report-to-fix days (y, symlog so same-day fixes still show). The power-law fit is nearly flat — size explains ~0.7% of the variance (R² = 0.007), so bigger changes don't
take longer to land.
1
2
10
20
100
200
1k
Churn sum
0
500
1,000
days, report → commit, power-law fit (R² = 0.007)
Category
Build & platform
Client interfaces
Client tools
Concurrency, locking & crashes
Data types, text & collation
Execution & correctness
Extensions & contrib
Indexes
Numeric, overflow & limits
Partitioning & inheritance
Planner & optimizer
Replication & recovery
Storage, vacuum & TOAST
power-law fit (R² = 0.007)
Data as of 21:42 UTC on 26 Oct 2026
made with
dbt Charts