AWS AmazonRDS: Aurora PostgreSQL release notes add 18.6/17.11/16.15/15.19/14.24 with CVE fixes
Summary
Adds release notes for new Aurora PostgreSQL minor versions (18.6, 17.11, 16.15, 15.19, 14.24) including back-ported fixes for numerous PostgreSQL community security CVEs, new hybrid key exchange (KEX) SSL algorithms, and various stability/performance fixes; also normalizes date formatting and wording.
Security assessment
The diff explicitly documents that these Aurora PostgreSQL releases back-port fixes for a long list of PostgreSQL community security CVEs, and adds hybrid post-quantum key exchange algorithms (X25519MLKEM768, SecP256r1MLKEM768) for SSL. This is concrete evidence of addressing known vulnerabilities and strengthening transport encryption, warranting high severity.
Evidence
* Back-ported fixes for the following PostgreSQL community security issues:
Diff
diff --git a/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md b/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md index 97e565c..a9aed75 100644 --- a//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md +++ b//AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.md @@ -56,0 +57,2 @@ For a list of AWS Regions, see [ Aurora PostgreSQL Region availability](https:// + * PostgreSQL 18.6 + @@ -63,0 +66,145 @@ For a list of AWS Regions, see [ Aurora PostgreSQL Region availability](https:// +### PostgreSQL 18.6 + +This release of Aurora PostgreSQL is compatible with PostgreSQL 18.6. For more information about the improvements in PostgreSQL 18.6, see [PostgreSQL release 18.6](https://www.postgresql.org/docs/18/release-18-6.html). + +###### Releases and patches + + * Aurora PostgreSQL 18.6, September 29, 2026 + + + + +#### Aurora PostgreSQL 18.6, September 29, 2026 + +**New features** + + * Reduced minor version and patch upgrade downtime by decreasing session serialization time for backends with temporary schemas. + + * Aurora PostgreSQL now parallelizes index maintenance during bulk inserts with `COPY FROM`, reducing load time for tables with many indexes. + + * Aurora PostgreSQL now automatically detects and removes invalid databases left behind by interrupted `DROP DATABASE` operations, preventing false alerts and upgrade failures. + + * Added support for hybrid key exchange (KEX) algorithms, such as `X25519MLKEM768` and `SecP256r1MLKEM768`, for SSL. + + * Added support for correlated aggregate subquery transformation, which rewrites correlated aggregate subqueries into window function equivalents to improve query performance. This feature is controlled by the `apg_enable_subquery_to_window_transform` parameter (default: `OFF`). + + + + +**Critical stability enhancements** + + * Fixed an issue in Aurora storage metadata that could prevent a database from starting when it reached the maximum volume size. + + * HypoPG now considers only the hypothetical indexes created by the current role during `EXPLAIN`. + + + + +**High priority enhancements** + + * Fixed an issue where an idle system incorrectly reported slightly higher IOPS. + + * Fixed an issue that could cause prolonged switchover times for global clusters when `aurora.enhanced_logical_replication` is enabled. + + * Fixed an issue where minor and patch upgrades could result in longer downtime due to a failure to process certain database parameters. + + * Fixed an issue in Aurora commit log initialization that caused inbound replication to fail in certain cases. + + * Fixed an issue in the `pg_columnmask` extension that could cause database unavailability when a table with both row-level security and masking policies was joined in a multi-table query. + + * Back-ported fixes for the following PostgreSQL community security issues: + + * [CVE-2026-6464](https://www.postgresql.org/support/security/CVE-2026-6464) + + * [CVE-2026-6469](https://www.postgresql.org/support/security/CVE-2026-6469) + + * [CVE-2026-6470](https://www.postgresql.org/support/security/CVE-2026-6470) + + * [CVE-2026-6471](https://www.postgresql.org/support/security/CVE-2026-6471) + + * [CVE-2026-14662](https://www.postgresql.org/support/security/CVE-2026-14662) + + * [CVE-2026-14663](https://www.postgresql.org/support/security/CVE-2026-14663) + + * [CVE-2026-14664](https://www.postgresql.org/support/security/CVE-2026-14664) + + * [CVE-2026-14666](https://www.postgresql.org/support/security/CVE-2026-14666) + + * [CVE-2026-14668](https://www.postgresql.org/support/security/CVE-2026-14668) + + * [CVE-2026-14669](https://www.postgresql.org/support/security/CVE-2026-14669) + + * [CVE-2026-14670](https://www.postgresql.org/support/security/CVE-2026-14670) + + * [CVE-2026-14671](https://www.postgresql.org/support/security/CVE-2026-14671) + + * [CVE-2026-14672](https://www.postgresql.org/support/security/CVE-2026-14672) + + * [CVE-2026-14673](https://www.postgresql.org/support/security/CVE-2026-14673) + + * [CVE-2026-14676](https://www.postgresql.org/support/security/CVE-2026-14676) + + * [CVE-2026-14677](https://www.postgresql.org/support/security/CVE-2026-14677) + + * [CVE-2026-14678](https://www.postgresql.org/support/security/CVE-2026-14678) + + * [CVE-2026-14679](https://www.postgresql.org/support/security/CVE-2026-14679) + + * [CVE-2026-14680](https://www.postgresql.org/support/security/CVE-2026-14680) + + * [CVE-2026-14681](https://www.postgresql.org/support/security/CVE-2026-14681) + + * [CVE-2026-15741](https://www.postgresql.org/support/security/CVE-2026-15741) + + * [CVE-2026-15742](https://www.postgresql.org/support/security/CVE-2026-15742) + + * [CVE-2026-16238](https://www.postgresql.org/support/security/CVE-2026-16238) + + * [CVE-2026-16239](https://www.postgresql.org/support/security/CVE-2026-16239) + + * [CVE-2026-16241](https://www.postgresql.org/support/security/CVE-2026-16241) + + * [CVE-2026-18024](https://www.postgresql.org/support/security/CVE-2026-18024) + + * [CVE-2026-18408](https://www.postgresql.org/support/security/CVE-2026-18408) + + * [CVE-2026-19385](https://www.postgresql.org/support/security/CVE-2026-19385) + + + + +**General enhancements** + + * Improved Aurora PostgreSQL resource usage by fixing several minor memory leaks. + + * Improved Aurora Serverless v2 scale-down to better retain frequently accessed data in the buffer cache. + + * Reduced downtime during major version upgrades by reducing Aurora I/O operations for user files. + + * Fixed an issue in minor and patch upgrades to support buffering of extended queries. + + * Fixed multiple issues to improve the reliability of client connections during database minor and patch upgrades that use Zero-Downtime Patching (ZDP). + + * Fixed an issue where inbound replicas could experience longer recovery times after a restart. + + * Improved CPU usage reporting in the `aurora_stat_resource_usage()` virtual function. + + * Added a new column, `worker_threads_cpu_usage_percent`, to the `aurora_stat_resource_usage()` function. This column reports the CPU usage percentage of a backend process's worker threads. For backend processes that don't use worker threads, the value is 0. + + * Fixed an issue that could cause a database instance to restart due to a memory management issue in Aurora Storage connection handling. + + * Fixed small memory leaks during database startup and replication. + + * Added the `aurora_volume_size_info()` function to report current volume usage, remaining space, and the soft limit (in bytes). + + * Fixed an issue where `EXPLAIN` output in JSON, XML, or YAML format could be malformed for query plans that include an Adaptive Join. + + * Fixed an issue where new databases created on the source RDS PostgreSQL cluster during inbound replication were inaccessible on the Aurora PostgreSQL replica. + + * Updated the following extensions: + + * pglogical to version 2.4.8. + + + + @@ -214 +361 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.4. For more i - * Fixed an issue that can cause a database instance to restart due to a memory management issue in storage node connection handling. + * Fixed an issue that can cause a database instance to restart due to a memory management issue in Aurora Storage connection handling. @@ -421,0 +569,2 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.3. For more i + * PostgreSQL 17.11 + @@ -438,0 +588,137 @@ This release of Aurora PostgreSQL is compatible with PostgreSQL 18.3. For more i +### PostgreSQL 17.11 + +This release of Aurora PostgreSQL is compatible with PostgreSQL 17.11. For more information about the improvements in PostgreSQL 17.11, see [PostgreSQL release 17.11](https://www.postgresql.org/docs/17/release-17-11.html). + +###### Releases and patches + + * Aurora PostgreSQL 17.11, September 29, 2026 + + + + +#### Aurora PostgreSQL 17.11, September 29, 2026 + +**New features** + + * Reduced minor version and patch upgrade downtime by decreasing session serialization time for backends with temporary schemas. + + * Aurora PostgreSQL now parallelizes index maintenance during bulk inserts with `COPY FROM`, reducing load time for tables with many indexes. + + + + +**Critical stability enhancements** + + * Fixed an issue in Aurora storage metadata that could prevent a database from starting when it reached the maximum volume size. + + * HypoPG now considers only the hypothetical indexes created by the current role during `EXPLAIN`. + + + + +**High priority enhancements** + + * Fixed an issue where an idle system incorrectly reported slightly higher IOPS. + + * Fixed an issue that could cause prolonged switchover times for global clusters when `aurora.enhanced_logical_replication` is enabled. + + * Fixed an issue where minor and patch upgrades could result in longer downtime due to a failure to process certain database parameters. + + * Fixed an issue in Aurora commit log initialization that caused inbound replication to fail in certain cases.