Buffer Over-read Vulnerability in PostgreSQL Packages: CVE-2025-4207
Summary
ALPINE-CVE-2025-4207: Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. Affects postgresql14 versions < 14.18-r0. Fixed in 14.18-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database system that uses and extends the SQL language. It is known for its reliability, feature robustness, and performance. The affected packages, postgresql14, postgresql15, postgresql16, and postgresql17, are versions of PostgreSQL that have been identified to contain a buffer over-read vulnerability related to GB18030 encoding validation. This vulnerability can lead to temporary denial of service on systems where a 1-byte over-read can cause process termination.
Vulnerability Detail
The vulnerability, identified as CVE-2025-4207, arises from a buffer over-read during GB18030 encoding validation in PostgreSQL. This flaw allows a malicious database input provider to exploit the vulnerability, potentially leading to a denial of service. The affected versions include PostgreSQL versions prior to 17.5, 16.9, 15.13, 14.18, and 13.21. The technical implications include the risk of process termination, which can disrupt database services and affect application availability.
How To Fix
Minimum fixed version
14.18-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql14Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patches as soon as they are available to mitigate the risk.
Conclusion
The buffer over-read vulnerability in PostgreSQL packages (CVE-2025-4207) poses a significant risk of denial of service. It is crucial for users of affected versions to update their packages to the latest patched versions to ensure the security and availability of their database systems.
See every vulnerability recorded for postgresql14 →
FAQ
CVE-2025-4207 is a vulnerability in PostgreSQL that allows for a buffer over-read during GB18030 encoding validation, potentially leading to denial of service.
The affected versions are PostgreSQL 14.18, 15.13, 16.9, and 17.5, along with earlier versions prior to these releases.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Update your PostgreSQL packages to the latest patched versions as outlined in the 'how to fix' section to secure your database.
While the primary risk is denial of service, it is advisable to apply patches promptly to avoid potential disruptions that could lead to data loss.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql14.
