Release Notes 0.18

0.18.1 - Security Update

FastTransfer 0.18.1 is a maintenance release. It fixes two .NET vulnerabilities in a bundled dependency and includes a consistency fix for the Ctid method. Upgrading is recommended for all 0.18.0 users.

Security Fixes

FastTransfer 0.18.0 and earlier bundle System.Security.Cryptography.Pkcs 9.0.13, a transitive dependency of the SQL Server and Oracle drivers. This version is affected by two vulnerabilities disclosed by Microsoft on October 13, 2026:

CVE	Severity	Issue	Platforms
CVE-2026-84008 (GHSA-846f-f764-76mx)	High (CVSS 7.5)	Denial of service: SignedCms.CheckSignature can repeatedly reparse attacker-controlled X.509 data, causing CPU exhaustion	Windows, Linux, macOS
CVE-2026-70162 (GHSA-2fmv-rv2c-59x7)	Moderate (CVSS 5.9)	Denial of service: EnvelopedCms.Decode can perform quadratic work on attacker-supplied CMS / PKCS#7 data, causing CPU exhaustion	Windows

FastTransfer 0.18.1 ships the patched version, System.Security.Cryptography.Pkcs 10.0.13.

Who is affected? All FastTransfer versions up to and including 0.18.0 contain the vulnerable library. The actual exposure is low:

• Both vulnerabilities only affect availability (high CPU usage). They cannot leak or modify your data.
• FastTransfer itself does not call the vulnerable APIs, and neither do the bundled drivers in a standard transfer (SQL Server, PostgreSQL, Oracle, MySQL, etc.). The license check does not use this library.
• The only related code path is SQL Server Always Encrypted with secure enclaves (VBS/HGS attestation). In that case, the SQL Server driver decodes signed data returned by the attestation service. It does not call the vulnerable CheckSignature method.

Vulnerability scanners (Dependabot, NuGet audit, binary scanners) flag the vulnerable version whatever the code path, so upgrading is still required for compliance.

How to fix it? Replace the FastTransfer binary with version 0.18.1. FastTransfer is a self-contained executable that embeds its own .NET runtime and libraries: updating the .NET runtime installed on the server does not fix it.

Dependency Updates

Package	0.18.0	0.18.1
System.Security.Cryptography.Pkcs	9.0.13	10.0.13
Microsoft.Data.SqlClient	7.0.1	7.1.1
Oracle.ManagedDataAccess.Core	23.26.200	23.26.301
Npgsql	10.0.2	10.0.3
MySqlConnector	2.5.0	2.6.2
DuckDB.NET.Data.Full	1.5.2	1.5.6.1
Teradata.Client.Provider	20.0.9	20.0.10
Microsoft.Extensions.Configuration / Logging, System.Data.Odbc / OleDb	10.0.8	10.0.13
Serilog	4.3.1	4.4.0

The .NET runtime embedded in the binary is 10.0.13, which includes the October 2026 .NET security fixes.

Bug Fixes

• Ctid method, pgcopy source and pgcopy target: every chunk now reads from the same snapshot (REPEATABLE READ with an exported snapshot). Before, these chunks each used their own READ COMMITTED snapshot, so a Ctid transfer of a table being written to could be inconsistent across chunks. Queries containing the word COPY (for example a table named COPYTABLE) are no longer truncated.

---

The sections below describe the changes introduced in 0.18.0.

New Parallel Methods

DBPartition

DBPartition uses the native partitions of the source table: each partition is transferred in its own stream, biggest partitions first. No distribute key column is needed.

• Sources: SQL Server (mssql, msoledbsql), PostgreSQL (pgsql, pgcopy), Oracle (oraodp), MySQL (mysql), Teradata (teradata, row partitioning only)
• Requires: --sourceschema and --sourcetable (--query is not allowed)
• Fallback: if the table is not partitioned, FastTransfer logs a warning and transfers it with None

./FastTransfer \
 --sourceconnectiontype "mssql" --sourceserver "localhost" --sourcedatabase "tpch" --sourcetrusted \
 --sourceschema "dbo" --sourcetable "lineitem_part" \
 --targetconnectiontype "pgcopy" --targetserver "localhost:5432" --targetdatabase "tpch" \
 --targetuser "postgres" --targetpassword "mypassword" \
 --targetschema "public" --targettable "lineitem" \
 --parallelmethod "DBPartition" --degree 8 --loadmode "Truncate"

See Parallel Parameters - DBPartition.

Timepartition

Timepartition splits the data on the time parts of a date column: one stream per year, month, day or ISO week, biggest first. --distributekeycolumn is a tuple:

Tuple	One stream per
(date_column,year)	Year
(date_column,year,month)	Month
(date_column,year,month,day)	Day
(date_column,year,week)	ISO week

• Works with a source table or a --query
• Rows with a NULL date are transferred in a dedicated stream

./FastTransfer \
 --sourceconnectiontype "mssql" --sourceserver "localhost" --sourcedatabase "tpch" --sourcetrusted \
 --query "SELECT * FROM dbo.lineitem WHERE l_shipmode = 'AIR'" \
 --targetconnectiontype "pgcopy" --targetserver "localhost:5432" --targetdatabase "tpch" \
 --targetuser "postgres" --targetpassword "mypassword" \
 --targetschema "public" --targettable "lineitem_air" \
 --parallelmethod "Timepartition" --distributekeycolumn "(l_shipdate,year,month)" --degree 8

See Parallel Parameters - Timepartition.

New Environment Variable: FASTTRANSFER_DATEFORMAT

Sets the format of the date bounds sent by the Timepartition method: yyyy-MM-dd (default) or yyyyMMdd.

# Windows (PowerShell)
$env:FASTTRANSFER_DATEFORMAT = "yyyyMMdd"

# Linux
export FASTTRANSFER_DATEFORMAT=yyyyMMdd

See FASTTRANSFER_DATEFORMAT.

Bug Fixes

• msbulk target, partitioned table with a rowstore clustered index: DataDriven (and the new DBPartition / Timepartition methods) no longer fail with "Cannot bulk load. The bulk data stream was incorrectly specified as sorted". The sorted hint is now only sent to heap and columnstore targets, or when FASTTRANSFER_SORTEDINPUT is true. See SQL Server target and sorted hint.
• pgcopy target, NULL values: NULL values coming from a non-PostgreSQL source are now loaded as NULL. Before, NULL dates (and other non-text types) failed the load with "invalid input syntax", and NULL text values were loaded as empty strings.

Wizard

The Command Wizard now offers the DBPartition and Timepartition methods.