Security Update for PostgreSQL: Addressing CREATE STATISTICS Privilege and Allocation Issues
Summary
ALSA-2026:0492: Moderate: postgresql:15 security update. Affects pg_repack versions < 1.4.8-2.module_el9.5.0+119+18833d03. Fixed in 1.4.8-2.module_el9.5.0+119+18833d03. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, extensibility, and SQL compliance. It supports a wide range of data types and offers advanced features such as transactions, concurrency, and complex queries. However, recent vulnerabilities have been identified that could compromise its security, particularly related to privilege checks and memory allocation.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include CVE-2025-12817, where the CREATE STATISTICS command does not properly check for the necessary schema CREATE privilege, potentially allowing unauthorized users to create statistics on a schema they do not own. Additionally, CVE-2025-12818 highlights an issue in the libpq library where undersized memory allocations can occur due to integer wraparound, leading to potential buffer overflows and application crashes. These vulnerabilities could be exploited by malicious actors to gain unauthorized access or disrupt database operations.
How To Fix
Minimum fixed version
1.4.8-2.module_el9.5.0+119+18833d03
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the CREATE STATISTICS command by adjusting user privileges in the database until the packages are updated. This can be done using the following SQL command:
REVOKE CREATE ON SCHEMA <schema_name> FROM <user_name>;
Conclusion
The identified vulnerabilities in PostgreSQL pose significant risks to database security, particularly regarding unauthorized access and potential application crashes. It is crucial for users to update their packages to the latest versions to mitigate these risks. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-12817 is a vulnerability in PostgreSQL where the CREATE STATISTICS command does not check for the necessary schema CREATE privilege, potentially allowing unauthorized users to create statistics.
CVE-2025-12818 refers to an issue in the libpq library of PostgreSQL where undersized memory allocations can occur due to integer wraparound, leading to potential buffer overflows.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider restricting access to the CREATE STATISTICS command and monitoring your database for any suspicious activity.
For detailed information, refer to the CVE pages for CVE-2025-12817 and CVE-2025-12818, which provide insights into the vulnerabilities and their potential impact.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
