Every release from 08.01.0102 to 18.00.0004 is affected. An application that builds IN lists from user input can be crashed, or left running on a corrupted heap.
PostgreSQL retires its RPM repositories for RHEL 10.0 and 9.6
EditorialBy TrustList Editorial
Packages for those minor releases, including PostgreSQL 18, move to the YUM archive and get no further updates; servers on RHEL, Rocky Linux or AlmaLinux 10.0 or 9.6 should move to a newer minor release.
About PostgreSQL retires its RPM repositories for RHEL 10.0 and 9.6
PostgreSQL retires its RPM repositories for RHEL 10.0 and 9.6
20 October 2026: The PostgreSQL project's RPM repository team is retiring the repositories it builds for Red Hat Enterprise Linux 10.0 and 9.6 and moving them to its YUM archive, where they "will not receive further updates". The same applies to Rocky Linux and AlmaLinux 10.0 and 9.6.
Not yet independently verified. The PostgreSQL project's post of 20 October 2026 announced the retirement without a date. By 10 November the RHEL 10.0 and 9.6 directories had gone from the main repository and sat in the YUM archive, so the exact switch date is still unknown to us. We will update this when it can be confirmed, and remove this note.
Update, 10 November 2026: The move has happened. On 10 November the rhel-10.0 and rhel-9.6 directories no longer answered in the main download tree for PostgreSQL 18, while the rolling rhel-10 and rhel-9 directories did, and rhel-10.0 loaded from the YUM archive.
What changes
All PostgreSQL major versions built for those two minor releases, including PostgreSQL 18, stay available in the archive, so existing servers can still install packages. What stops is new builds: future PostgreSQL minor releases, including security fixes, will not be published for these targets. The rolling EL-10 and EL-9 repository RPMs, which follow the current minor release of each major version, are not affected.
Servers pinned to a minor release
The change hits servers that are pinned to a specific minor release of RHEL or a compatible distribution, rather than tracking the latest one. That is common where a hardware certification, a vendor support matrix or a regulated change process fixes the operating system version, and it is also typical of Extended Update Support set-ups. On such servers, PostgreSQL packages from the PGDG repository will quietly stop getting updates, and a later PostgreSQL security release will not arrive through the normal channel. Nothing breaks on the day the repository moves, which is what makes the change easy to miss: the server keeps running the build it already has, and the next dnf update simply finds nothing new for PostgreSQL.
Moving on, or living with the archive
The project gives two options: update to a newer minor release of the operating system, or point the server at the archive, accepting that it will not receive further updates. The archived-repositories section of its repository packages page generates the repository file and install commands for each distribution version, architecture and PostgreSQL version.
For most teams the first option is the right one, because staying on a frozen repository means missing PostgreSQL's own security fixes. Database and platform teams should check which minor release each database host runs and which repository file it uses, and plan the operating system update alongside the next PostgreSQL minor upgrade. Questions can go to the project's packaging mailing list or its issue tracker. Our RDBMS software category lists 35 products.
Sources
- PostgreSQL: RHEL 10.0 and 9.6 repositories are being retired, 20 October 2026
- PostgreSQL YUM repository: archived repositories (read 2026-10-20), 20 October 2026
- PostgreSQL YUM archive: PostgreSQL 18 for RHEL 10.0 (read 10 November 2026), 10 November 2026
Categories & features
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
A user who knows one SCRAM password can log in as any other SCRAM user, superusers included, on PgBouncer 1.17.0 to 1.26.0. Two further flaws let unauthenticated clients hang the pooler under specific settings.
The project had planned an October release. Between eight and ten features, including SQL/PGQ graph queries, were pulled from the branch during beta and move to PostgreSQL 20.
DigitalOcean is removing plans above 4 GiB RAM and standby and read-only nodes from managed PostgreSQL and MySQL Standard Edition. New database accounts from 15 October 2026, all accounts from 30 November. Existing clusters are not affected.
An attacker used a compromised GitHub account and leaked credentials for four weeks, copying customer contacts, contract terms, SQL editor text and encrypted API keys. PingCAP says the databases themselves were not reached.
From 28 September 2026 Cloud SQL’s Viewer, Reader and legacy Viewer roles no longer carry the export permission, so exports using them fail. Cloud Service Mesh’s ISTIOD control planes on GKE are deprecated, with support ending on 1 March 2028.
CVE-2026-112816 lets anyone who can reach the API and holds a trusted client's public certificate act as that client, up to root on the host. Fixed snaps went out on 29 October.
Every musl release from 0.5.0 to 1.2.6 is affected. The maintainers ship a patch now and say 1.2.7 will follow; only programs that compile regular expressions from untrusted input are exposed.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- More PostgreSQLThe ranking for this subject
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.