DocumentationVersion comparison
POSTGRESQL · VERSION COMPARE
All features, fixes, and compatibility notes in this release, with related records from other versions.
Includes changes after the source version through the target. A major version name means its initial release.
From PostgreSQL 9.0 onward: 17 major branches and 352 release notes. Updated 2026-09-26.
Complete release changes
2026-02-12
16.12 SupportedSupport ends 2028-11-09
| CVE / issue | Severity | Fixed version |
|---|---|---|
| CVE-2026-2006 Fix inadequate validation of multibyte character lengths | 8.8 | 16.12 |
| CVE-2026-2005 Fix buffer overrun in contrib/pgcrypto's PGP decryption functions | 8.8 | 16.12 |
| CVE-2026-2004 Harden selectivity estimators against being attached to operators that accept unexpected data types | 8.8 | 16.12 |
| CVE-2026-2003 Guard against unexpected dimensions of oidvector/int2vector | 4.3 | 16.12 |
A dump/restore is not required for those running 16.X.
However, if you are upgrading from a version earlier than 16.10, see Section E.6.
Changes
Guard against unexpected dimensions of oidvector/int2vector (Tom Lane) §
These data types are expected to be 1-dimensional arrays containing no nulls, but there are cast pathways that permit violating those expectations. Add checks to some functions that were depending on those expectations without verifying them, and could misbehave in consequence.
The PostgreSQL Project thanks Altan Birler for reporting this problem. (CVE-2026-2003)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Harden selectivity estimators against being attached to operators that accept unexpected data types (Tom Lane) § § §
contrib/intarray contained a selectivity estimation function that could be abused for arbitrary code execution, because it did not check that its input was of the expected data type. Third-party extensions should check for similar hazards and add defenses using the technique intarray now uses. Since such extension fixes will take time, we now require superuser privilege to attach a non-built-in selectivity estimator to an operator.
The PostgreSQL Project thanks Daniel Firer, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2004)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix buffer overrun in contrib/pgcrypto's PGP decryption functions (Michael Paquier) §
Decrypting a crafted message with an overlength session key caused a buffer overrun, with consequences as bad as arbitrary code execution.
The PostgreSQL Project thanks Team Xint Code, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2005)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix inadequate validation of multibyte character lengths (Thomas Munro, Noah Misch) § § § § § §
Assorted bugs allowed an attacker able to issue crafted SQL to overrun string buffers, with consequences as bad as arbitrary code execution. After these fixes, applications may observe “invalid byte sequence for encoding” errors when string functions process invalid text that has been stored in the database.
The PostgreSQL Project thanks Paul Gerste and Moritz Sanft, as part of zeroday.cloud, for reporting this problem. (CVE-2026-2006)
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Don't allow CTE references in sub-selects to determine semantic levels of aggregate functions (Tom Lane) §
This change undoes a change made two minor releases ago, instead throwing an error if a sub-select references a CTE that's below the semantic level that standard SQL rules would assign to the aggregate based on contained column references and aggregates. The attempted fix turned out to cause problems of its own, and it's unclear what to do instead. Since sub-selects within aggregates are disallowed altogether by the SQL standard, treating such cases as errors seems sufficient.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix trigger transition table capture for MERGE in CTE queries (Dean Rasheed) §
When executing a data-modifying CTE query containing both a MERGE and another DML operation on a table with statement-level AFTER triggers, the transition tables passed to the triggers would not include the rows affected by the MERGE, only those affected by the other operation(s).
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix failure when all children of a partitioned target table of an update or delete have been pruned (Amit Langote) §
In such cases, the executor could report “could not find junk ctid column” errors, even though nothing needs to be done.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Avoid possible planner failure when a query contains duplicate window function calls (Meng Zhang, David Rowley) §
Confusion over de-duplication of such calls could result in errors like “WindowFunc with winref 2 assigned to WindowAgg with winref 1”.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Allow indexscans on partial hash indexes even when the index's predicate implies the truth of the WHERE clause (Tom Lane) §
Normally we drop a WHERE clause that is implied by the predicate, since it's pointless to test it; it must hold for every index entry. However that can prevent creation of an indexscan plan if the index is one that requires a WHERE clause on the leading index key, as hash indexes do. Don't drop implied clauses when considering such an index.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Do not emit WAL for unlogged BRIN indexes (Kirill Reshke) §
One seldom-taken code path incorrectly emitted a WAL record relating to a BRIN index even if the index was marked unlogged. Crash recovery would then fail to replay that record, complaining that the file already exists.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Prevent truncation of CLOG that is still needed by unread NOTIFY messages (Joel Jacobson, Heikki Linnakangas) § § §
This fix prevents “could not access status of transaction” errors when a backend is slow to absorb NOTIFY messages.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Escalate errors occurring during NOTIFY message processing to FATAL, i.e. close the connection (Heikki Linnakangas) §
Formerly, if a backend got an error while absorbing a NOTIFY message, it would advance past that message, report the error to the client, and move on. That behavior was fraught with problems though. One big concern is that the client has no good way to know that a notification was lost, and certainly no way to know what was in it. Depending on the application logic, missing a notification could cause the application to get stuck waiting, for example. Also, any remaining messages would not get processed until someone sent a new NOTIFY.
Also, if the connection is idle at the time of receiving a NOTIFY signal, any ERROR would be escalated to FATAL anyway, due to unrelated concerns. Therefore, we've chosen to make that happen in all cases, for consistency and to provide a clear signal to the application that it might have missed some notifications.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix bug in following update chain when locking a tuple (Jasper Smit) §
This code path neglected to check the xmin of the first new tuple in the update chain, making it possible to lock an unrelated tuple if the original updater aborted and the space was immediately reclaimed by VACUUM and then re-used. That could cause unexpected transaction delays or deadlocks. Errors associated with having identified the wrong tuple have also been observed.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix issues around in-place catalog updates (Noah Misch) § § §
Send a nontransactional invalidation message for an in-place update, since such an update will survive transaction rollback. Also ensure that the update is WAL-logged before other sessions can see it. These fixes primarily prevent scenarios in which relations' frozen-XID attributes become inconsistent, possibly allowing premature CLOG truncation and subsequent “could not access status of transaction” errors.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix potential backend process crash at process exit due to trying to release a lock in an already-unmapped shared memory segment (Rahila Syed) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Guard against incorrect truncation of the multixact log after a crash (Heikki Linnakangas) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix possibly mis-encoded result of pg_stat_get_backend_activity() (Chao Li) §
The shared-memory buffer holding a session's activity string can end with an incomplete multibyte character. Readers are supposed to truncate off any such incomplete character, but this function failed to do so.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Guard against recursive memory context logging (Fujii Masao) §
A constant flow of signals requesting memory context logging could cause recursive execution of the logging code, which in theory could lead to stack overflow.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix memory context usage when reinitializing a parallel execution context (Jakub Wartak, Jeevan Chalke) §
This error could result in a crash due to a subsidiary data structure having a shorter lifespan than the parallel context. The problem is not known to be reachable using only core PostgreSQL, but we have reports of trouble in extensions.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Set next multixid's offset when creating a new multixid, to remove the wait loop that was needed in corner cases (Andrey Borodin) § §
The previous logic could get stuck waiting for an update that would never occur.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Avoid rewriting data-modifying CTEs more than once (Bernice Southey, Dean Rasheed) §
Formerly, when updating an auto-updatable view or a relation with rules, if the original query had any data-modifying CTEs, the rewriter would rewrite those CTEs multiple times due to recursion. This was inefficient and could produce false errors if a CTE included an update of an always-generated column.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fail recovery if WAL does not exist back to the redo point indicated by the checkpoint record (Nitin Jadhav) §
Add an explicit check for this before starting recovery, so that no harm is done and a useful error message is provided. Previously, recovery might crash or corrupt the database in this situation.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Avoid scribbling on the source query tree during ALTER PUBLICATION (Sunil S) §
This error had the visible effect that an event trigger fired for the query would see only the first publish option, even if several had been specified. If such a query were set up as a prepared statement, re-executions would misbehave too.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Pass connection options specified in CREATE SUBSCRIPTION ... CONNECTION to the publisher's walsender (Fujii Masao) §
Before this fix, the options connection option (if any) was ignored, thus for example preventing setting custom server parameter values in the walsender session. It was intended for that to work, and it did work before refactoring in PostgreSQL version 15 broke it, so restore the previous behavior.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Prevent invalidation of newly created or newly synced replication slots (Zhijie Hou) §
A race condition with a concurrent checkpoint could allow WAL to be removed that is needed by the replication slot, causing the slot to immediately get marked invalid.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix race condition in computing a replication slot's required xmin (Zhijie Hou) §
This could lead to the error “cannot build an initial slot snapshot as oldest safe xid follows snapshot's xmin”.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
During initial synchronization of a logical replication subscription, commit the addition of a pg_replication_origin entry before starting to copy data (Zhijie Hou) §
Previously, if the copy step failed, the new pg_replication_origin entry would be lost due to transaction rollback. This led to inconsistent state in shared memory.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Don't advance logical replication progress after a parallel worker apply failure (Zhijie Hou) §
The previous behavior allowed transactions to be lost by a subscriber.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix possible failure with “unexpected data beyond EOF” during restart of a streaming replica server (Anthonin Bonnefoy) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix erroneous tracking of column position when parsing partition range bounds (myzhen) §
This could, for example, lead to the wrong column name being cited in error messages about casting partition bound values to the column's data type.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix assorted minor errors in error messages (Man Zeng, Tianchen Zhang) § § §
For example, an error report about mismatched timeline number in a backup manifest showed the starting timeline number where it meant to show the ending timeline number.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix failure to perform function inlining when doing JIT compilation with LLVM version 17 or later (Anthonin Bonnefoy) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Adjust our JIT code to work with LLVM 21 (Holger Hoffstätte) §
The previous coding failed to compile on aarch64 machines.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Add new server parameter file_extend_method to control use of posix_fallocate() (Thomas Munro) §
PostgreSQL version 16 and later will use posix_fallocate(), if the platform provides it, to extend relation files. However, this has been reported to interact poorly with some file systems: BTRFS compression is disabled by the use of posix_fallocate(), and XFS could produce spurious ENOSPC errors in older Linux kernel versions. To provide a workaround, introduce this new server parameter. Setting file_extend_method to write_zeros will cause the server to return to the old method of extending files by writing blocks of zeroes.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Honor open()'s O_CLOEXEC flag on Windows (Bryan Green, Thomas Munro) § § §
Make this flag work like it does on POSIX platforms, so that we don't leak file handles into child processes such as COPY TO/FROM PROGRAM. While that leakage hasn't caused many problems, it seems undesirable.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix failure to parse long options on the server command line in Solaris executables built with meson (Tom Lane) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Support process title changes on GNU/Hurd (Michael Banck) §
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Make pg_resetwal print the updated value when changing OldestXID (Heikki Linnakangas) §
It already did that for every other variable it can change.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Make pg_resetwal allow setting next multixact xid to 0 or next multixact offset to UINT32_MAX (Maxim Orlov) §
These are valid values, so rejecting them was incorrect. In the worst case, if a pg_upgrade is attempted when exactly at the point of multixact wraparound, the upgrade would fail.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
In contrib/amcheck, use the correct snapshot for btree index parent checks (Mihail Nikalayeu) §
The previous coding caused spurious errors when examining indexes created with CREATE INDEX CONCURRENTLY.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix contrib/amcheck to handle “half-dead” btree index pages correctly (Heikki Linnakangas) §
amcheck expected such a page to have a parent downlink, but it does not, leading to a false error report about “mismatch between parent key and child high key”.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix contrib/amcheck to handle incomplete btree root page splits correctly (Heikki Linnakangas) §
amcheck could report a false error about “block is not true root”.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix edge-case integer overflow in contrib/intarray's selectivity estimator for @@ (Chao Li) §
This could cause poor selectivity estimates to be produced for cases involving the maximum integer value.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Fix multibyte-encoding issue in contrib/ltree (Jeff Davis) §
The previous coding could pass an incomplete multibyte character to lower(), probably resulting in incorrect behavior.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Changes
Update time zone data files to tzdata release 2025c (Tom Lane) §
The only change is in historical data for pre-1976 timestamps in Baja California.
“Same change” requires complete matching evidence. “Related commits” can cover independent changes, a partial backport, or a follow-up correction; each release keeps its own explanation.
Try another search, or .
The comparison follows PostgreSQL release notes from just after the source through the target version. For a major upgrade, maintenance releases from each older branch are included only up to the next major release date, and never after the target date. A major version such as 18 means its initial release, 18.0. Previews and development snapshots are labeled separately.
Entries come from the original English manuals. Release coverage and commit evidence are verified against upstream sources. Every entry retains its complete explanation and source link. Categories aid browsing; read the full notes for impact, conditions, and migration steps.
Fixes can be backported to several branches. Confirmed duplicates are merged conservatively, with every branch explanation retained. A note describing several independent fixes is excluded only when all are already present in the source. Major-release features remain distinct from related maintenance patches unless their complete original descriptions match. Uncertain matches are retained. This is a release-note history, not an exhaustive comparison of compiled binaries.
CVE results are calculated independently from the PostgreSQL security registry and vulnerability records. A CVE counts as gained protection only when the source is affected and the target is fixed or unaffected. Remaining vulnerabilities are listed separately. Security entries and distinct CVEs are counted separately.
Interaction inspired by pgversions.com and pgversionreport. Content comes from PostgreSQL release notes. See the release notes archive.