Security Update for PostgreSQL: Addressing CREATE STATISTICS Privilege and Memory Allocation Issues
Summary
ALSA-2026:0519: Moderate: postgresql:16 security update. Affects pg_repack versions < 1.5.1-1.module_el8.10.0+3930+ecf33554. Fixed in 1.5.1-1.module_el8.10.0+3930+ecf33554. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PostgreSQL is a powerful, open-source object-relational database management system (DBMS) known for its robustness, scalability, and support for advanced data types. It is widely used in various applications for managing large datasets and complex queries. However, recent vulnerabilities have been identified that could compromise its security, specifically related to the CREATE STATISTICS privilege and memory allocation in the libpq library.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, the CREATE STATISTICS command does not adequately check for the necessary schema CREATE privileges, potentially allowing unauthorized users to create statistics on tables they should not have access to (CVE-2025-12817). Second, the libpq library has an integer wraparound issue that leads to undersized memory allocations, which could be exploited to cause application crashes or arbitrary code execution (CVE-2025-12818). These vulnerabilities could have serious implications for data integrity and application stability.
How To Fix
Minimum fixed version
1.5.1-1.module_el8.10.0+3930+ecf33554
This is the first release that contains the fix.
sudo dnf update pg_repackTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the CREATE STATISTICS command by managing user privileges more strictly until the packages are updated. This can be done by reviewing and modifying the roles and permissions assigned to users in the database.
Conclusion
In summary, the identified vulnerabilities in PostgreSQL related to the CREATE STATISTICS command and memory allocation issues pose significant risks to database security and application stability. It is crucial for users to update their packages promptly and manage user privileges effectively to mitigate these risks.
See every vulnerability recorded for pg_repack →
FAQ
The CREATE STATISTICS vulnerability allows unauthorized users to create statistics on tables, which could lead to data exposure and unauthorized data manipulation.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
If immediate updates are not possible, ensure that user privileges are tightly controlled to mitigate the risk of unauthorized access.
While specific exploits may not be publicly available, the nature of the vulnerabilities suggests that they could be exploited to compromise database security and application stability.
It is recommended to regularly check for updates, ideally on a weekly basis, to ensure that you are protected against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for pg_repack.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
