Critical Security Update for PostgreSQL: Quoting API Vulnerability
Summary
ALSA-2025:1741: Important: postgresql:15 security update. Affects pg_repack versions < 1.4.8-2.module_el9.5.0+120+4533eb20. Fixed in 1.4.8-2.module_el9.5.0+120+4533eb20. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and compliance with SQL standards. It supports a wide range of data types and offers powerful features such as transactions, sub-selects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could compromise the security of applications relying on PostgreSQL, particularly concerning its quoting APIs.
Vulnerability Detail
The vulnerability arises from PostgreSQL's quoting APIs, which fail to neutralize quoting syntax in text that does not pass encoding validation. This flaw, identified as CVE-2025-1094, can potentially allow attackers to execute arbitrary code or manipulate database queries, leading to unauthorized access or data corruption. The issue is particularly critical as it affects the integrity and security of the database operations.
How To Fix
Minimum fixed version
1.4.8-2.module_el9.5.0+120+4533eb20
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the PostgreSQL database and implementing additional input validation to mitigate the risk of exploitation until the update can be applied.
Conclusion
The PostgreSQL quoting API vulnerability (CVE-2025-1094) poses significant risks to database security. Users are strongly advised to update their PostgreSQL packages to the latest patched versions to mitigate these risks. Additionally, temporary workarounds can help protect against potential exploitation until updates are applied.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-1094 is a vulnerability in PostgreSQL's quoting APIs that fails to neutralize quoting syntax in improperly encoded text, potentially allowing for SQL injection attacks.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, data corruption, or execution of arbitrary code within the database.
Yes, patched versions of the affected PostgreSQL packages are available, and users are encouraged to update to these versions immediately.
If an immediate update is not possible, implement strict access controls and input validation to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
