PostgreSQL: minor updates, major upgrades and security

Updated November 2026

PostgreSQL ships fixes in minor releases at least every three months. They contain only bug and security fixes, so you install the package and restart, with no dump or migration. Moving to a new major version is a separate, planned job. PostgreSQL 14 reaches end of life on November 12, 2026, so plan its upgrade now.

18.6Current minor of the newest major (August 13, 2026)
Nov 12, 2026Next minor release; final release of 14
5 yearsSupport for each major version

What PostgreSQL is

PostgreSQL is an open-source relational database developed by the PostgreSQL Global Development Group. Web applications, analytics systems and many commercial products run on it, often with extensions such as PostGIS. One server process (the postmaster) runs each database cluster, meaning one data directory. A host can run several clusters of different major versions at once, which matters when you upgrade.

Check the installed version

psql --version                                # client version
sudo -u postgres psql -c 'SELECT version();'  # running server
pg_lsclusters                                 # Debian, Ubuntu: every cluster, port and status

The client and server can have different versions, so check the running server. Then see where the packages came from:

apt policy postgresql-17                      # Debian, Ubuntu: use your major number
rpm -qa | grep -i postgres                    # RHEL family, SUSE
apk info -v | grep postgresql                 # Alpine
pkg info | grep postgresql                    # FreeBSD

Supported versions

A new major version comes out about once a year and gets 5 years of support. After that, the project releases one final minor version and stops.

PostgreSQL support, as of November 3, 2026
Major	Current minor	First release	Final release
18	18.6	September 25, 2025	November 14, 2030
17	17.11	September 26, 2024	November 8, 2029
16	16.15	September 14, 2023	November 9, 2028
15	15.19	October 13, 2022	November 11, 2027
14	14.24	September 30, 2021	November 12, 2026
13 and older	13.23 …	—	Ended (13 on November 13, 2025)

PostgreSQL 19 is at the release-candidate stage (RC 1 came out on October 15, 2026). Don't run release candidates in production. Minor releases are planned for the second Thursday of February, May, August and November. The next ones are due on November 12, 2026 and February 11, 2027. Urgent fixes can come out between those dates.

The August 13, 2026 release (18.6, 17.11, 16.15, 15.19, 14.24) was a security release. Several of its flaws were rated CVSS 8.8, including a type confusion bug in cursor handling that can lead to arbitrary code execution. Also fixed was a heap buffer overflow in pg_dump. If your minor version is older than these, update now.

Distro packages or PGDG repository

Each distribution ships one or a few majors and backports fixes into them, which means copying the security patches into the version it shipped. As of November 2026, Debian 13 ships 17 and Debian 12 ships 15. Ubuntu 26.04 ships 18, 24.04 ships 16 and 22.04 ships 14. RHEL 10 ships 16. RHEL 9 offers 16, 15 and 13 as modules. Red Hat supports its streams for its own lifecycle, which can run past the upstream end-of-life date. On Ubuntu 22.04, PostgreSQL 14 passes its upstream end of life this month, so follow Ubuntu's notices or move to a newer major.

The PostgreSQL Global Development Group (PGDG) runs its own repositories with every supported major version. They plug into your normal package manager. On Debian and Ubuntu:

sudo apt install -y postgresql-common
sudo /usr/share/postgresql-common/pgdg/apt.postgresql.org.sh

If you set it up by hand, check that the key fingerprint is B97B 0AFC AA1A 47F0 44F2 44A0 7FCC 7D46 ACCC 4CF8. On RHEL 9 (x86_64 shown; for RHEL 10 use EL-10-x86_64 in the URL):

sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm
sudo dnf -qy module disable postgresql      # RHEL 8 and 9 only; RHEL 10 has no modules
sudo dnf install -y postgresql18-server

PGDG RPM packages install into /usr/pgsql-18/ and their service is called postgresql-18.

Apply a minor update

# Debian, Ubuntu (distro or PGDG)
sudo apt update
sudo apt install --only-upgrade postgresql-17 postgresql-client-17 libpq5

# RHEL family (distro or PGDG)
sudo dnf upgrade --refresh 'postgresql*'

# SUSE
sudo zypper refresh
sudo zypper update postgresql17 postgresql17-server

# Alpine (as root)
apk -U upgrade postgresql17 postgresql17-client

# FreeBSD (as root)
pkg upgrade postgresql18-server postgresql18-client

# Docker: pull the same major tag, then recreate the container
docker pull postgres:18
docker compose up -d

Use your own major number in the package names. Read the release notes before you update: sometimes a minor release asks you to reindex something or run an extra step after the update. With Docker, never point a newer major tag at an existing data volume. A new major version cannot start on an old data directory.

Restart and verify

A minor update only takes effect when the server restarts. A restart drops all connections for a few seconds. First check that the configuration files load cleanly:

sudo -u postgres psql -c 'SELECT * FROM pg_file_settings WHERE error IS NOT NULL;'
sudo -u postgres psql -c 'SELECT * FROM pg_hba_file_rules WHERE error IS NOT NULL;'

Both queries should return no rows. Then restart. Each of these commands restarts the database:

sudo systemctl restart postgresql@17-main      # Debian, Ubuntu (one cluster)
sudo systemctl restart postgresql              # RHEL distro packages
sudo systemctl restart postgresql-18           # PGDG RPM packages
rc-service postgresql restart                  # Alpine, as root
service postgresql restart                     # FreeBSD, as root

Then confirm the new version and a recent start time:

sudo -u postgres psql -c 'SELECT version(), pg_postmaster_start_time();'

On a replicated setup, update and restart the standbys first, then switch over or restart the primary.

Plan major upgrades

Minor updates are routine patching. Major upgrades change the data format and need a plan.

A new major version changes the on-disk format. You either dump and reload the data or use pg_upgrade. You can skip majors (for example 14 straight to 17), but read the release notes of every version in between. On Debian and Ubuntu, the pg_upgradecluster tool handles this. Install the new major first, then:

pg_lsclusters
sudo pg_upgradecluster 14 main          # upgrades to the newest installed major
# test the application, then remove the old cluster:
sudo pg_dropcluster 14 main

By default it uses dump and restore, which is slow but safe. -m upgrade (or -m link) uses pg_upgrade and is much faster on large databases. The new cluster takes over the old port, and the old cluster moves to an unused port and is set not to start at boot. Take a backup before you begin, and see database recovery if something goes wrong.

Keep port 5432 private

Bots constantly try passwords against exposed PostgreSQL servers. A superuser login is especially dangerous. COPY … FROM PROGRAM runs shell commands on the server as the operating system user that runs PostgreSQL, so attackers use it to drop cryptominers (cryptojacking) or wipe data and leave a ransom note. By default listen_addresses is localhost. Check that nobody has widened it:

sudo ss -tlnp | grep -E ':5432\b'
sudo -u postgres psql -c 'SHOW listen_addresses;'

If other hosts must connect, listen on a private address only. In pg_hba.conf, allow named hosts or subnets with scram-sha-256, for example host appdb appuser 10.0.0.5/32 scram-sha-256. Never use trust on a host line: it lets anyone who can connect log in as any user without a password. Reload after you edit pg_hba.conf with SELECT pg_reload_conf();. A change to listen_addresses needs a full restart. Firewall the port as well; see firewall basics.

Where advisories appear

PostgreSQL security information: a table of every known vulnerability with affected and fixed versions. Report new issues to security@postgresql.org.
The pgsql-announce mailing list. Subscribe with only the Security tag to get security news without the other announcements.
The minor release roadmap, so you can book maintenance windows in advance.
Your distribution's tracker for backported fixes, and our vulnerability pages.

Quick hardening tips

Keep listen_addresses on localhost or a private address, and firewall 5432.
Use scram-sha-256 passwords (the current default). MD5 password support is deprecated. Rehash old MD5 passwords by setting them again.
Don't let applications connect as postgres or any superuser. Give each application its own role with only the rights it needs.
Grant pg_execute_server_program and the server-file roles to no one who doesn't truly need them.
Require TLS (hostssl lines) for connections that leave the host.
Keep tested, off-server backups (pg_dump or a physical backup tool). See backups.
Write the end-of-life date of your major version in your calendar a year ahead.