CVE-2025-12818
published 2025-11-13CVE-2025-12818: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an…
PriorityP432medium5.9CVSS 3.1
AVNACHPRNUINSUCNINAH
EPSS
0.33%
25.4th percentile
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | postgresql-13 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-15 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-17 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| debian | postgresql-18 | < postgresql-13 13.23-0+deb11u1 (bullseye) | postgresql-13 13.23-0+deb11u1 (bullseye) |
| msrc | azl3_postgresql_16.10-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.75.0-22_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_rust_1.90.0-4_on_azure_linux_3.0 | — | — |
| msrc | cbl2_postgresql_14.19-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
vendor_ubuntu3.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
osv·2025-12-03·CVSS 3.1
CVE-2025-12817 [LOW] postgresql-14, postgresql-16, postgresql-17 vulnerabilities
postgresql-14, postgresql-16, postgresql-17 vulnerabilities
Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command
did not correctly check for schema CREATE privileges. An authenticated
attacker could possibly use this issue to create a denial of service
against other CREATE STATISTICS users. (CVE-2025-12817)
Aleksey Solovev discovered that the PostgreSQL libpq client library
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause libpq to crash, resulting in a denial of
service. (CVE-2025-12818)
GHSA
GHSA-pr6x-gg24-6wfp: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to unders
ghsa_unreviewed·2025-11-13
CVE-2025-12818 [MEDIUM] CWE-190 GHSA-pr6x-gg24-6wfp: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to unders
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
OSV
CVE-2025-12818: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to unders
osv·2025-11-13·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818: Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to unders
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2025-12-03·CVSS 3.1
CVE-2025-12817 [LOW] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: Several security issues were fixed in PostgreSQL.
Jelte Fennema-Nio discovered that the PostgreSQL CREATE STATISTICS command
did not correctly check for schema CREATE privileges. An authenticated
attacker could possibly use this issue to create a denial of service
against other CREATE STATISTICS users. (CVE-2025-12817)
Aleksey Solovev discovered that the PostgreSQL libpq client library
incorrectly handled certain memory operations. A remote attacker could
possibly use this issue to cause libpq to crash, resulting in a denial of
service. (CVE-2025-12818)
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart PostgreSQL to
make all the necessary changes.
Red Hat
postgresql: libpq: libpq undersizes allocations, via integer wraparound
vendor_redhat·2025-11-13·CVSS 5.9
CVE-2025-12818 [MEDIUM] CWE-190 postgresql: libpq: libpq undersizes allocations, via integer wraparound
postgresql: libpq: libpq undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
A vulnerability has been identified in PostgreSQL’s libpq client library, where integer wraparound in several allocation-size calculations allows a peer or input provider to cause an undersized buffer and then write out-of-bounds by hundreds of megabytes. This can lead to a client application segmentation fault or crash when using libpq to connect to a
Microsoft
PostgreSQL libpq undersizes allocations, via integer wraparound
vendor_msrc·2025-11-11·CVSS 5.9
CVE-2025-12818 [MEDIUM] CWE-190 PostgreSQL libpq undersizes allocations, via integer wraparound
PostgreSQL libpq undersizes allocations, via integer wraparound
Mariner: Mariner
PostgreSQL: PostgreSQL
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Debian
CVE-2025-12818: postgresql-13 - Integer wraparound in multiple PostgreSQL libpq client library functions allows ...
vendor_debian·2025·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818: postgresql-13 - Integer wraparound in multiple PostgreSQL libpq client library functions allows ...
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Scope: local
bullseye: resolved (fixed in 13.23-0+deb11u1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-12818 libpq: libpq undersizes allocations, via integer wraparound [fedora-42]
bugzilla·2025-11-26·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818 libpq: libpq undersizes allocations, via integer wraparound [fedora-42]
CVE-2025-12818 libpq: libpq undersizes allocations, via integer wraparound [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close all bug r
Bugzilla
CVE-2025-12818 postgresql17: libpq undersizes allocations, via integer wraparound [fedora-42]
bugzilla·2025-11-17·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818 postgresql17: libpq undersizes allocations, via integer wraparound [fedora-42]
CVE-2025-12818 postgresql17: libpq undersizes allocations, via integer wraparound [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close al
Bugzilla
CVE-2025-12818 mingw-postgresql: libpq undersizes allocations, via integer wraparound [fedora-42]
bugzilla·2025-11-17·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818 mingw-postgresql: libpq undersizes allocations, via integer wraparound [fedora-42]
CVE-2025-12818 mingw-postgresql: libpq undersizes allocations, via integer wraparound [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to clos
Bugzilla
CVE-2025-12818 postgresql16: libpq undersizes allocations, via integer wraparound [fedora-42]
bugzilla·2025-11-17·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818 postgresql16: libpq undersizes allocations, via integer wraparound [fedora-42]
CVE-2025-12818 postgresql16: libpq undersizes allocations, via integer wraparound [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora Linux 42 on 2026-05-13.
It is Fedora's policy to close al
Bugzilla
CVE-2025-12818 postgresql: libpq: libpq undersizes allocations, via integer wraparound
bugzilla·2025-11-13·CVSS 5.9
CVE-2025-12818 [MEDIUM] CVE-2025-12818 postgresql: libpq: libpq undersizes allocations, via integer wraparound
CVE-2025-12818 postgresql: libpq: libpq undersizes allocations, via integer wraparound
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.4 Extended Update Support
Via RHSA-2025:22728 https://access.redhat.com/errata/RHSA-2025:22728
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Via RHSA-2025:230
2025-11-13
Published