PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql17Upgrade postgresql16 | Aug 18, 2025 | Aug 14, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-test-rpm-macrosUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-llvmjitUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgresql-testUpgrade postgresqlUpgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-docsUpgrade postgresql-serverUpgrade postgresql-private-libs | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql15-private-libs-debuginfoUpgrade postgresql16-docsUpgrade postgresql16-test-rpm-macrosUpgrade postgresql17-docsUpgrade postgresql16-server-develUpgrade postgresql16-contribUpgrade postgresql15-plpython3Upgrade postgresql16-staticUpgrade postgresql17-plpython3Upgrade postgresql16-serverUpgrade postgresql17-llvmjitUpgrade postgresql15-contribUpgrade postgresql15-plperl-debuginfoUpgrade postgresql17-staticUpgrade postgresql15-private-libsUpgrade postgresql17-serverUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql17-docs-debuginfoUpgrade postgresql16-upgrade-develUpgrade postgresql17Upgrade postgresql16-plpython3Upgrade postgresql17-contribUpgrade postgresql17-testUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql15-docs-debuginfoUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql15-pltclUpgrade postgresql15-private-develUpgrade postgresql15-llvmjitUpgrade postgresql16Upgrade postgresql16-plperlUpgrade postgresql17-debugsourceUpgrade postgresql16-upgradeUpgrade postgresql15-debugsourceUpgrade postgresql16-server-debuginfoUpgrade postgresql15-debuginfoUpgrade postgresql15-staticUpgrade postgresql16-private-libsUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql16-test-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-debuginfoUpgrade postgresql17-upgradeUpgrade postgresql17-pltclUpgrade postgresql17-plperlUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql17-server-debuginfoUpgrade postgresql17-private-libsUpgrade postgresql17-debuginfoUpgrade postgresql15-test-debuginfoUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql17-server-develUpgrade postgresql16-plperl-debuginfoUpgrade postgresql17-test-debuginfoUpgrade postgresql15-server-develUpgrade postgresql15-testUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql16-pltclUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql16-contrib-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql17-plperl-debuginfoUpgrade postgresql16-testUpgrade postgresql15-test-rpm-macrosUpgrade postgresql16-llvmjitUpgrade postgresql15Upgrade postgresql17-test-rpm-macrosUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-private-develUpgrade postgresql15-upgrade-develUpgrade postgresql15-docsUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql15-serverUpgrade postgresql17-upgrade-develUpgrade postgresql17-contrib-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql17-private-develUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql15-plperlUpgrade postgresql15-contrib-debuginfo | Sep 9, 2025 | Aug 14, 2025 |
| Debian | — | Upgrade postgresql-15Upgrade postgresql-13Upgrade postgresql-17 | Aug 18, 2025 | Aug 18, 2025 |
| Freebsd | — | Upgrade postgresql16-serverUpgrade postgresql17-serverUpgrade postgresql15-serverUpgrade postgresql13-serverUpgrade postgresql14-server | Dec 10, 2025 | Aug 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Postgres | — | Upgrade to PostgreSQL version 17.6Upgrade to PostgreSQL version 16.10Upgrade to PostgreSQL version 14.19Upgrade to PostgreSQL version 15.14 | Aug 15, 2025 | Aug 14, 2025 |
| Redhat_linux | — | Upgrade postgresql-private-develUpgrade postgresql-staticUpgrade postgresql-testUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-contribUpgrade postgresql-pltclUpgrade pgauditUpgrade postgresql-server-debuginfoUpgrade postgresqlUpgrade pg_repackUpgrade postgres-decoderbufsUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-test-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgradeUpgrade pg_repack-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-debugsourceUpgrade pgvector-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-pltcl-debuginfoUpgrade pgvectorUpgrade postgresql-plpython3Upgrade postgresql-contrib-debuginfoNo solution existsUpgrade pgaudit-debuginfoUpgrade postgresql-docs-debuginfoUpgrade pgaudit-debugsourceUpgrade pgvector-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-devel | Nov 14, 2025 | Aug 14, 2025 |
| Suse | — | Upgrade postgresql17-plperlUpgrade postgresql16-plpythonUpgrade postgresql16Upgrade postgresql14-docsUpgrade postgresql13-contribUpgrade postgresql15-docsUpgrade postgresql17-server-develUpgrade postgresql14-server-develUpgrade postgresql14-pltclUpgrade postgresql14-testUpgrade libecpg6Upgrade postgresql15-serverUpgrade postgresql16-develUpgrade postgresql17-contribUpgrade postgresql16-server-develUpgrade postgresql14Upgrade postgresql15-plperlUpgrade postgresql16-contribUpgrade postgresql16-pltclUpgrade postgresql15-testUpgrade postgresql15-server-develUpgrade postgresql16-llvmjitUpgrade postgresql13-server-develUpgrade postgresql15-develUpgrade postgresql17-testUpgrade postgresql17-develUpgrade postgresql17-llvmjitUpgrade libpq5Upgrade postgresql13-serverUpgrade postgresql15-llvmjitUpgrade postgresql14-develUpgrade postgresql13-docsUpgrade postgresql14-llvmjit-develUpgrade postgresql14-plperlUpgrade postgresql15Upgrade postgresql13-llvmjit-develUpgrade postgresql13-plpythonUpgrade postgresql16-plperlUpgrade postgresql15-llvmjit-develUpgrade postgresql16-testUpgrade postgresql14-llvmjitUpgrade postgresql17-pltclUpgrade postgresql13Upgrade postgresql15-pltclUpgrade postgresql13-pltclUpgrade postgresql13-plperlUpgrade postgresql17-llvmjit-develUpgrade postgresql17-docsUpgrade postgresql17-serverUpgrade postgresql15-contribUpgrade postgresql16-docsUpgrade postgresql15-plpythonUpgrade postgresql14-plpythonUpgrade postgresql14-contribUpgrade libecpg6-32bitUpgrade postgresql16-llvmjit-develUpgrade postgresql13-testUpgrade postgresql17-plpythonUpgrade postgresql17Upgrade postgresql16-serverUpgrade postgresql14-serverUpgrade postgresql13-llvmjitUpgrade postgresql13-develUpgrade libpq5-32bit | Dec 5, 2025 | Aug 18, 2025 |
| Ubuntu | — | Upgrade postgresql-16Upgrade postgresql-client-14Upgrade postgresql-client-16Upgrade postgresql-14Upgrade postgresql-17Upgrade postgresql-client-17 | Sep 9, 2025 | Aug 14, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 22, 2025 | Aug 14, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub