# PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 Released!

**URL:** <https://forum.devtalk.com/t/postgresql-18-1-17-7-16-11-15-15-14-20-and-13-23-released/222550>\
**Category:** Backend Official News\
**Tags:** newsbot, postgres, postgresql, official-news\
**Created:** [13 November 2025 16:29 UTC](https://forum.devtalk.com/t/postgresql-18-1-17-7-16-11-15-15-14-20-and-13-23-released/222550 "2025-11-13T16:29:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![NewsBot](https://forum.devtalk.com/user_avatar/forum.devtalk.com/newsbot/32/1114_2.png) [@NewsBot](https://forum.devtalk.com/u/NewsBot)\
**Post date:** [13 November 2025 16:29 UTC](https://forum.devtalk.com/t/postgresql-18-1-17-7-16-11-15-15-14-20-and-13-23-released/222550/1 "2025-11-13T16:29:43Z")

</div>

A new [PostgreSQL](https://devtalk.com/postgresql) blog post/announcement has been posted!

> [@](#):
>
> The PostgreSQL Global Development Group has released an update to all supported versions of PostgreSQL, including 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. This release fixes 2 security vulnerabilities and over 50 bugs reported over the last several months.
> 
> For the full list of changes, please review the [release notes](https://www.postgresql.org/docs/release/).
> 
> ## PostgreSQL 13 EOL Notice
> 
> **This is the final release of PostgreSQL 13**. PostgreSQL 13 is now end-of-life and will no longer receive security and bug fixes. If you are running PostgreSQL 13 in a production environment, we suggest that you make plans to upgrade to a newer, supported version of PostgreSQL. Please see our [versioning policy](https://www.postgresql.org/support/versioning/) for more information.
> 
> ## Security Issues
> 
> ### [CVE-2025-12817](https://www.postgresql.org/support/security/CVE-2025-12817/): PostgreSQL `CREATE STATISTICS` does not check for schema `CREATE` privilege
> 
> CVSS v3.1 Base Score: [3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?version=3.1&vector=AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
> 
> Supported, Vulnerable Versions: 13 - 18.
> 
> Missing authorization in PostgreSQL [`CREATE STATISTICS`](https://www.postgresql.org/docs/current/sql-createstatistics.html) command allows a table owner to achieve denial of service against other `CREATE STATISTICS` users by creating in any schema. A later `CREATE STATISTICS` for the same name, from a user having the `CREATE` privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
> 
> The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.
> 
> ### [CVE-2025-12818](https://www.postgresql.org/support/security/CVE-2025-12818/): PostgreSQL libpq undersizes allocations, via...

Get the full details here: [PostgreSQL: PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 Released!](https://www.postgresql.org/about/news/postgresql-181-177-1611-1515-1420-and-1323-released-3171/)