Security Update for PostgreSQL: Addressing CREATE STATISTICS Privilege and Memory Allocation Issues
Summary
ALSA-2026:0523: Moderate: postgresql:13 security update. Affects pg_repack across 2 version ranges.
< 1.4.6-3.module_el8.6.0+2760+1746ec94
< 1.4.6-3.module_el8.6.0+3095+ee60d910
Fixed in 1.4.6-3.module_el8.6.0+2760+1746ec94 or 1.4.6-3.module_el8.6.0+3095+ee60d910, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide range of data types and offers advanced features such as transactions, subselects, triggers, views, and stored procedures. However, vulnerabilities can arise in any software, including PostgreSQL, which can potentially compromise database security and integrity.
Vulnerability Detail
The vulnerability stems from two main issues: first, the CREATE STATISTICS command does not adequately check for the necessary schema CREATE privileges, allowing unauthorized users to create statistics in schemas where they lack permissions (CVE-2025-12817). Second, the libpq library has an integer wraparound issue that can lead to undersized memory allocations, potentially causing application crashes or memory corruption (CVE-2025-12818). These vulnerabilities can be exploited to gain unauthorized access or disrupt database operations.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update pg_repack-
< 1.4.6-3.module_el8.6.0+2760+1746ec941.4.6-3.module_el8.6.0+2760+1746ec94 -
< 1.4.6-3.module_el8.6.0+3095+ee60d9101.4.6-3.module_el8.6.0+3095+ee60d910
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that only authorized users have access to the CREATE STATISTICS command and monitor memory usage closely to prevent potential crashes. Additionally, consider implementing stricter access controls on schemas to mitigate unauthorized access until the packages are updated.
Conclusion
The vulnerabilities in PostgreSQL related to CREATE STATISTICS privileges and libpq memory allocation issues pose significant risks to database security and stability. It is crucial to update the affected packages to their patched versions to mitigate these risks. Users should also consider implementing temporary workarounds and monitoring their systems closely until updates are applied.
See every vulnerability recorded for pg_repack →
FAQ
It allows unauthorized users to create statistics in schemas where they lack permissions, potentially leading to data exposure.
The integer wraparound can cause undersized memory allocations, leading to application crashes or memory corruption.
Versions prior to the patched releases, specifically those before 13.23, are affected.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities in your application without needing to sign up.
Implement stricter access controls and monitor your database closely until you can apply the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
