diff --git a/config/programs.m4 b/config/programs.m4
index bcdfbc3a51..ce83155592 100644
--- a/config/programs.m4
+++ b/config/programs.m4
@@ -65,10 +65,8 @@ AC_SUBST(BISONFLAGS)
 # PGAC_PATH_FLEX
 # --------------
 # Look for Flex, set the output variable FLEX to its path if found.
-# Reject versions before 2.5.31, as we need a reasonably non-buggy reentrant
-# scanner.  (Note: the well-publicized security problem in 2.5.31 does not
-# affect Postgres, and there are still distros shipping patched 2.5.31,
-# so allow it.)  Also find Flex if its installed under `lex', but do not
+# Reject versions before 2.5.35 (the earliest version in the buildfarm
+# as of 2022). Also find Flex if its installed under `lex', but do not
 # accept other Lex programs.
 
 AC_DEFUN([PGAC_PATH_FLEX],
@@ -92,14 +90,14 @@ else
         echo '%%'  > conftest.l
         if $pgac_candidate -t conftest.l 2>/dev/null | grep FLEX_SCANNER >/dev/null 2>&1; then
           pgac_flex_version=`$pgac_candidate --version 2>/dev/null`
-          if echo "$pgac_flex_version" | sed ['s/[.a-z]/ /g'] | $AWK '{ if ([$]1 == 2 && ([$]2 > 5 || ([$]2 == 5 && [$]3 >= 31))) exit 0; else exit 1;}'
+          if echo "$pgac_flex_version" | sed ['s/[.a-z]/ /g'] | $AWK '{ if ([$]1 == 2 && ([$]2 > 5 || ([$]2 == 5 && [$]3 >= 35))) exit 0; else exit 1;}'
           then
             pgac_cv_path_flex=$pgac_candidate
             break 2
           else
             AC_MSG_WARN([
 *** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
-*** Flex version 2.5.31 or later is required, but this is $pgac_flex_version.])
+*** Flex version 2.5.35 or later is required, but this is $pgac_flex_version.])
           fi
         fi
       fi
diff --git a/configure b/configure
index 4a725ab205..613c385c48 100755
--- a/configure
+++ b/configure
@@ -10278,17 +10278,17 @@ else
         echo '%%'  > conftest.l
         if $pgac_candidate -t conftest.l 2>/dev/null | grep FLEX_SCANNER >/dev/null 2>&1; then
           pgac_flex_version=`$pgac_candidate --version 2>/dev/null`
-          if echo "$pgac_flex_version" | sed 's/[.a-z]/ /g' | $AWK '{ if ($1 == 2 && ($2 > 5 || ($2 == 5 && $3 >= 31))) exit 0; else exit 1;}'
+          if echo "$pgac_flex_version" | sed 's/[.a-z]/ /g' | $AWK '{ if ($1 == 2 && ($2 > 5 || ($2 == 5 && $3 >= 35))) exit 0; else exit 1;}'
           then
             pgac_cv_path_flex=$pgac_candidate
             break 2
           else
             { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING:
 *** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
-*** Flex version 2.5.31 or later is required, but this is $pgac_flex_version." >&5
+*** Flex version 2.5.35 or later is required, but this is $pgac_flex_version." >&5
 $as_echo "$as_me: WARNING:
 *** The installed version of Flex, $pgac_candidate, is too old to use with PostgreSQL.
-*** Flex version 2.5.31 or later is required, but this is $pgac_flex_version." >&2;}
+*** Flex version 2.5.35 or later is required, but this is $pgac_flex_version." >&2;}
           fi
         fi
       fi
diff --git a/doc/src/sgml/install-windows.sgml b/doc/src/sgml/install-windows.sgml
index 499fd59bf0..c00ab2b4b2 100644
--- a/doc/src/sgml/install-windows.sgml
+++ b/doc/src/sgml/install-windows.sgml
@@ -220,7 +220,7 @@ $ENV{MSBFLAGS}="/m";
       <productname>Bison</productname> and <productname>Flex</productname> are
       required to build from Git, but not required when building from a release
       file. Only <productname>Bison</productname> versions 2.3 and later
-      will work. <productname>Flex</productname> must be version 2.5.31 or later.
+      will work. <productname>Flex</productname> must be version 2.5.35 or later.
      </para>
 
      <para>
diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml
index 7f7f8428e1..9daa656a04 100644
--- a/doc/src/sgml/installation.sgml
+++ b/doc/src/sgml/installation.sgml
@@ -314,7 +314,7 @@ su - postgres
       <application>Flex</application> and <application>Bison</application>
       are needed to build from a Git checkout, or if you changed the actual
       scanner and parser definition files. If you need them, be sure
-      to get <application>Flex</application> 2.5.31 or later and
+      to get <application>Flex</application> 2.5.35 or later and
       <application>Bison</application> 2.3 or later. Other <application>lex</application>
       and <application>yacc</application> programs cannot be used.
      </para>
diff --git a/src/backend/utils/misc/guc-file.l b/src/backend/utils/misc/guc-file.l
index 4f43430db4..721628c0cf 100644
--- a/src/backend/utils/misc/guc-file.l
+++ b/src/backend/utils/misc/guc-file.l
@@ -332,8 +332,8 @@ record_config_file_error(const char *errmsg,
 /*
  * Flex fatal errors bring us here.  Stash the error message and jump back to
  * ParseConfigFp().  Assume all msg arguments point to string constants; this
- * holds for flex 2.5.31 (earliest we support) and flex 2.5.35 (latest as of
- * this writing).  Otherwise, we would need to copy the message.
+ * holds for flex 2.5.35 (earliest we support). Otherwise, we would need to
+ * copy the message.
  *
  * We return "int" since this takes the place of calls to fprintf().
 */
diff --git a/src/tools/msvc/pgflex.pl b/src/tools/msvc/pgflex.pl
index eb3198381f..b62478b9f5 100644
--- a/src/tools/msvc/pgflex.pl
+++ b/src/tools/msvc/pgflex.pl
@@ -21,7 +21,7 @@ $flexver = (split(/\s+/, $flexver))[1];
 $flexver =~ s/[^0-9.]//g;
 my @verparts = split(/\./, $flexver);
 unless ($verparts[0] == 2
-	&& ($verparts[1] > 5 || ($verparts[1] == 5 && $verparts[2] >= 31)))
+	&& ($verparts[1] > 5 || ($verparts[1] == 5 && $verparts[2] >= 35)))
 {
 	print "WARNING! Flex install not found, or unsupported Flex version.\n";
 	print "echo Attempting to build without.\n";