PostgreSQL Statistics Leak Vulnerability in PostgreSQL Packages
Summary
CVE-2025-8713: PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Affects postgresql15 versions < 15.14-r0. Fixed in 15.14-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source relational database system that uses and extends the SQL language. It is known for its robustness, extensibility, and support for advanced data types. The affected packages, including postgresql-13, postgresql-15, postgresql-16, and postgresql-17, are versions of PostgreSQL that are vulnerable to a specific issue where optimizer statistics can be exploited to read data that should be restricted by access control lists (ACLs) and row security policies.
Vulnerability Detail
The vulnerability, identified as CVE-2025-8713, allows users to read sampled data from views they do not have access to, as well as bypass row security policies. This issue arises from PostgreSQL's method of maintaining statistics for tables by sampling data, which can be manipulated to leak sensitive information. Previous vulnerabilities, CVE-2017-7484 and CVE-2019-10130, aimed to address similar issues, but a gap remained that this vulnerability exposes. Affected versions include PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 or earlier.
How To Fix
Minimum fixed version
15.14-r0
This is the first release that contains the fix.
sudo apk add --upgrade postgresql15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to sensitive views and implementing stricter row security policies until the packages can be updated. Regularly review user permissions and access controls to minimize exposure.
Conclusion
The CVE-2025-8713 vulnerability in PostgreSQL packages poses a significant risk by allowing unauthorized access to sensitive data through optimizer statistics. It is crucial to update to the latest patched versions to mitigate this risk and ensure the security of your database systems.
See every vulnerability recorded for postgresql15 →
FAQ
CVE-2025-8713 is a vulnerability in PostgreSQL that allows unauthorized users to read sampled data from views and bypass row security policies.
Affected versions include PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 or earlier.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include unauthorized access to sensitive data and potential data leaks, which can compromise user privacy and security.
Restrict access to sensitive views and review user permissions regularly to minimize exposure while planning for an update.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql15.
