PostgreSQL Security Update: Vulnerabilities in PostgreSQL Packages
Summary
ALSA-2026:0491: Moderate: postgresql security update. Affects postgresql versions < 13.23-1.el9_7. Fixed in 13.23-1.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PostgreSQL is an advanced object-relational database management system (DBMS) known for its robustness, extensibility, and SQL compliance. It supports a wide range of data types and offers powerful features such as transactions, sub-selects, triggers, views, and stored procedures. However, recent vulnerabilities have been identified that could potentially compromise the security of PostgreSQL installations, particularly in version 13.23 and earlier.
Vulnerability Detail
The vulnerabilities stem from two main issues: first, the CREATE STATISTICS command does not adequately check for the necessary schema CREATE privilege, which could allow unauthorized users to create statistics in schemas they do not own (CVE-2025-12817). Second, the libpq library has an integer wraparound issue that leads to undersized allocations, potentially causing memory corruption or denial of service (CVE-2025-12818). These vulnerabilities could be exploited by attackers to gain unauthorized access or disrupt database operations.
How To Fix
Minimum fixed version
13.23-1.el9_7
This is the first release that contains the fix.
sudo dnf update postgresqlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict access to the CREATE STATISTICS command by adjusting user privileges and ensuring that only authorized users have the necessary permissions to execute this command. Additionally, monitoring and logging database activities can help detect any unauthorized attempts to exploit these vulnerabilities.
Conclusion
The identified vulnerabilities in PostgreSQL highlight the importance of maintaining up-to-date software to protect against potential security threats. By applying the recommended updates and implementing best practices for database security, users can significantly reduce their risk of exploitation.
See every vulnerability recorded for postgresql →
FAQ
The main vulnerabilities include inadequate privilege checks for the CREATE STATISTICS command and an integer wraparound issue in the libpq library.
You can check your PostgreSQL version and compare it with the patched version 13.23-1.el9_7. Additionally, using tools like Vulert can help monitor for vulnerabilities in your software.
Update to the latest patched version of PostgreSQL and review user privileges to ensure that only authorized users can execute sensitive commands.
Yes, Vulert offers a service that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
If immediate updates are not possible, consider implementing stricter access controls and monitoring database activities to mitigate potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for postgresql.
