Security Update for PostgreSQL: Addressing CREATE STATISTICS Privilege and Memory Allocation Issues
Summary
ALSA-2026:0524: Moderate: postgresql:15 security update. Affects pg_repack versions < 1.4.8-1.module_el8.9.0+3706+885c732e. Fixed in 1.4.8-1.module_el8.9.0+3706+885c732e. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and support for complex queries. It is widely used in various applications for managing structured data. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of PostgreSQL installations, particularly affecting the CREATE STATISTICS command and memory allocation processes.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include CVE-2025-12817, where the CREATE STATISTICS command does not properly check for the necessary schema CREATE privilege, allowing unauthorized users to create statistics on tables they do not own. Additionally, CVE-2025-12818 involves an undersized memory allocation in the libpq library, which can lead to integer wraparound issues, potentially causing application crashes or unexpected behavior. These vulnerabilities pose significant risks, including unauthorized data access and application instability.
How To Fix
Minimum fixed version
1.4.8-1.module_el8.9.0+3706+885c732e
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the CREATE STATISTICS command by implementing stricter role-based access controls within PostgreSQL. However, this is not a permanent solution and updating the affected packages is strongly recommended.
Conclusion
In summary, the identified vulnerabilities in PostgreSQL pose significant risks to database security and stability. It is crucial for users to update their installations to the latest patched versions to mitigate these risks effectively. Implementing temporary workarounds can provide limited protection, but they should not replace the need for a comprehensive update.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-12817 is a vulnerability in PostgreSQL where the CREATE STATISTICS command does not check for the necessary schema CREATE privilege, potentially allowing unauthorized users to create statistics.
CVE-2025-12818 refers to a vulnerability in PostgreSQL's libpq library, where undersized memory allocations can lead to integer wraparound issues, causing application crashes.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If immediate updates are not possible, consider implementing stricter access controls to mitigate the risks associated with the vulnerabilities.
More information can be found on the CVE pages linked in the advisory, which detail the vulnerabilities, their impacts, and the necessary updates.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
