Security Update for PostgreSQL: Addressing CREATE STATISTICS Privilege and Memory Allocation Issues
Summary
ALSA-2026:0493: Moderate: postgresql:16 security update. Affects pg_repack versions < 1.5.1-1.module_el9.6.0+146+c54fdeca. Fixed in 1.5.1-1.module_el9.6.0+146+c54fdeca. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, extensibility, and standards compliance. It supports a wide variety of data types and offers advanced features such as transactions, concurrency, and complex queries. However, recent vulnerabilities have been identified that could compromise the security and stability of PostgreSQL installations, specifically affecting packages like pg_repack, pgaudit, and others within the AlmaLinux ecosystem.
Vulnerability Detail
The vulnerabilities identified in PostgreSQL include CVE-2025-12817, where the CREATE STATISTICS command does not properly check for the necessary schema CREATE privileges, potentially allowing unauthorized users to create statistics in schemas they do not own. Additionally, CVE-2025-12818 highlights an issue in the libpq library where memory allocations are undersized due to integer wraparound, which could lead to memory corruption and application crashes. These vulnerabilities could be exploited by attackers to gain unauthorized access or disrupt database operations.
How To Fix
Minimum fixed version
1.5.1-1.module_el9.6.0+146+c54fdeca
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CREATE STATISTICS command by modifying user privileges within the database. This can be done by executing the following SQL command:
REVOKE CREATE ON SCHEMA <schema_name> FROM <user_name>; Replace <schema_name> with the name of the schema and <user_name> with the name of the user.
Conclusion
The identified vulnerabilities in PostgreSQL pose significant risks to database security and stability. It is crucial for users to update their affected packages promptly to mitigate these risks. By following the provided steps for updating and implementing temporary workarounds, users can protect their systems until a full resolution is achieved.
See every vulnerability recorded for pg_repack →
FAQ
CVE-2025-12817 is a vulnerability in PostgreSQL where the CREATE STATISTICS command does not check for schema CREATE privileges, potentially allowing unauthorized users to create statistics.
CVE-2025-12818 refers to an issue in the libpq library of PostgreSQL where memory allocations are undersized due to integer wraparound, which can lead to memory corruption.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If immediate updates are not possible, consider restricting access to the CREATE STATISTICS command as a temporary workaround until you can apply the necessary updates.
For detailed information about the vulnerabilities, including their impact and CVSS scores, refer to the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
