Critical Security Flaw in libpq Package: PostgreSQL Client Library Vulnerability
Summary
ALSA-2025:1737: Important: libpq security update. Affects libpq versions < 13.20-1.el8_10. Fixed in 13.20-1.el8_10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The libpq package is the PostgreSQL client library that enables client applications to connect to PostgreSQL database servers. It is a crucial component for applications that rely on PostgreSQL for data storage and management. The library provides various functionalities, including connection handling, query execution, and result processing. However, a recent vulnerability has been identified that affects the quoting APIs within this library, potentially exposing applications to security risks.
Vulnerability Detail
The vulnerability arises from the PostgreSQL quoting APIs failing to neutralize quoting syntax in text that does not pass encoding validation. This flaw, identified as CVE-2025-1094, can lead to SQL injection attacks, where an attacker could manipulate queries by injecting malicious SQL code. If exploited, this vulnerability could compromise the integrity of the database and expose sensitive data.
How To Fix
Minimum fixed version
13.20-1.el8_10
This is the first release that contains the fix.
sudo dnf update libpqTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement input validation and sanitization in your application to mitigate the risk of SQL injection attacks until the package is updated. Ensure that any user input is properly escaped and validated before being used in SQL queries.
Conclusion
The libpq package has a critical vulnerability that could expose applications to SQL injection attacks. It is crucial to update to the patched version to ensure the security of your PostgreSQL connections. Implementing workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for libpq →
FAQ
CVE-2025-1094 is a security vulnerability in the PostgreSQL quoting APIs that allows for potential SQL injection attacks due to improper handling of quoting syntax.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability could allow attackers to execute arbitrary SQL commands, potentially leading to data breaches or corruption.
Yes, a patch is available. You should update to version 13.20-1.el8_10 of the libpq and libpq-devel packages to mitigate the vulnerability.
If immediate updates are not possible, implement input validation and sanitization in your application to reduce the risk of SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for libpq.
