CVE-2025-12817
published 2025-11-13CVE-2025-12817: Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by…
PriorityP413low3.1CVSS 3.1
AVNACHPRLUINSUCNINAL
EPSS
0.22%
12.7th percentile
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-17 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-18 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| msrc | azl3_postgresql_16.10-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_postgresql_14.19-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.13.1LOWCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
osv3.1LOW
vendor_debian3.1LOW
vendor_msrc3.1LOW
vendor_redhat3.1LOW
vendor_ubuntu3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2025-12-03·CVSS 3.1
CVE-2025-12817 [LOW] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command
did not correctly check for schema CREATE privileges. An authenticated
attacker could possibly use this issue to create a denial of service
against other CREATE STATISTICS users. (CVE-2025-12817)
Aleksey Solovev discovered that the PostgreSQL libpq client library
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause libpq to crash, resulting in a denial of
service. (CVE-2025-12818)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Red Hat
postgresql: CREATE STATISTICS does not check for schema CREATE privilege
vendor_redhat·2025-11-13·CVSS 3.1
CVE-2025-12817 [LOW] CWE-862 postgresql: CREATE STATISTICS does not check for schema CREATE privilege
postgresql: CREATE STATISTICS does not check for schema CREATE privilege
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
A vulnerability has been identified in PostgreSQL’s CREATE STATISTICS command where the database does not check that the user has the required schema CREATE privilege. A table owner user could create a statistics object in any schema, blocking other users who legitimately hold CREATE STATISTICS permissions from creating objects with the same name. This result
Microsoft
PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
vendor_msrc·2025-11-11·CVSS 3.1
CVE-2025-12817 [LOW] CWE-862 PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
Mariner: Mariner
PostgreSQL: PostgreSQL
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-12817: postgresql-13 - Missing authorization in PostgreSQL CREATE STATISTICS command allows a table own...
vendor_debian·2025·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817: postgresql-13 - Missing authorization in PostgreSQL CREATE STATISTICS command allows a table own...
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Scope: local
bullseye: resolved (fixed in 13.23-0+deb11u1)
OSV
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
osv·2025-12-03·CVSS 3.1
CVE-2025-12817 [LOW] postgresql-14, postgresql-16, postgresql-17 vulnerabilities
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command
did not correctly check for schema CREATE privileges. An authenticated
attacker could possibly use this issue to create a denial of service
against other CREATE STATISTICS users. (CVE-2025-12817)
Aleksey Solovev discovered that the PostgreSQL libpq client library
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause libpq to crash, resulting in a denial of
service. (CVE-2025-12818)
OSV
CVE-2025-12817: Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users
osv·2025-11-13·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817: Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
GHSA
GHSA-99qj-9hw7-85x8: Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users
ghsa_unreviewed·2025-11-13
CVE-2025-12817 [LOW] CWE-862 GHSA-99qj-9hw7-85x8: Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-12817 postgresql16: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
bugzilla·2025-11-17·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817 postgresql16: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
CVE-2025-12817 postgresql16: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to
Bugzilla
CVE-2025-12817 postgresql17: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
bugzilla·2025-11-17·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817 postgresql17: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
CVE-2025-12817 postgresql17: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to
Bugzilla
CVE-2025-12817 mingw-postgresql: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
bugzilla·2025-11-17·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817 mingw-postgresql: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
CVE-2025-12817 mingw-postgresql: CREATE STATISTICS does not check for schema CREATE privilege [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy
Bugzilla
CVE-2025-12817 postgresql: CREATE STATISTICS does not check for schema CREATE privilege
bugzilla·2025-11-13·CVSS 3.1
CVE-2025-12817 [LOW] CVE-2025-12817 postgresql: CREATE STATISTICS does not check for schema CREATE privilege
CVE-2025-12817 postgresql: CREATE STATISTICS does not check for schema CREATE privilege
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2025:22728 https://access.redhat.com/errata/RHSA-2025:22728
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Via RHSA-2025:23022 http
2025-11-13
Published