CVE-2026-73515: PostGIS Out-of-Bounds Read Vulnerability via FlatGeobuf Buffer
Summary
CVE-2026-73515: PostGIS < 3.7.0 Out-of-Bounds Read via FlatGeobuf Buffer. Affects postgis versions < 3.7.0. Fixed in 3.7.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostGIS is an extension for the PostgreSQL database that adds support for geographic objects, allowing location queries to be run in SQL. It is widely used for geospatial data management and analysis. The package is known for its robust features, including support for various geospatial formats and functions. However, prior to version 3.7.0, PostGIS is vulnerable to an out-of-bounds read issue that can lead to memory disclosure or server crashes when processing malformed FlatGeobuf buffers.
Vulnerability Detail
The vulnerability arises from the FlatGeobuf property metadata decoder in PostGIS versions before 3.7.0. It verifies the presence of a string length field but fails to ensure that the subsequent string body is contained within the supplied buffer. This oversight allows attackers to exploit the vulnerability, potentially leading to memory disclosure or denial of service, as the application may attempt to access memory outside the allocated buffer.
How To Fix
Minimum fixed version
3.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any FlatGeobuf buffers being processed are validated and sanitized before being supplied to PostGIS. This can help mitigate the risk of triggering the vulnerability until an update can be applied.
Conclusion
In summary, CVE-2026-73515 represents a significant vulnerability in PostGIS that can lead to serious security issues if not addressed. Users are strongly advised to update to version 3.7.0 or later to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for postgis →
FAQ
CVE-2026-73515 is an out-of-bounds read vulnerability in PostGIS that can lead to memory disclosure or server crashes.
PostGIS versions prior to 3.7.0 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to memory disclosure, which may expose sensitive data, or cause a denial of service, leading to application crashes.
Yes, upgrading to PostGIS version 3.7.0 or later will patch this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for postgis.
