PostgreSQL Statistics Exposure Vulnerability in PostgreSQL 15, 16, and 17 Packages
Summary
ALPINE-CVE-2025-8713: PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Affects postgresql15 versions < 15.14-r0. Fixed in 15.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types and performance optimization features. However, certain versions of PostgreSQL have been found to have a vulnerability that allows unauthorized access to sensitive statistics data, which could lead to data leaks and breaches of security policies.
Vulnerability Detail
The vulnerability arises from the way PostgreSQL handles optimizer statistics, which can inadvertently expose sampled data from views that a user should not have access to. This flaw allows users to bypass access control lists (ACLs) and row security policies, potentially leading to unauthorized data exposure. Specifically, the issue affects versions prior to PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22, where crafted queries could exploit this weakness to access sensitive information.
How To Fix
Minimum fixed version
15.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing stricter access controls and reviewing your row security policies to minimize the risk of unauthorized data access until the package can be updated.
Conclusion
The PostgreSQL statistics exposure vulnerability poses a significant risk to data security by allowing unauthorized access to sensitive information. It is crucial for users of affected PostgreSQL versions to update their packages to the latest patched versions to mitigate this risk. Implementing temporary workarounds can help reduce exposure until updates are applied.
See every vulnerability recorded for postgresql15 →
FAQ
The vulnerability allows unauthorized users to read sampled data from views and bypass row security policies.
Versions prior to PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, implement stricter access controls and review your security policies as a temporary measure.
Detailed information can be found in the CVE report for CVE-2025-8713 and the Alpine vulnerability database.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql15.
