Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgis-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgisUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade pg_repackUpgrade postgis-clientUpgrade postgresql-server-develUpgrade postgis-docsUpgrade postgis-utilsUpgrade postgresql-testUpgrade postgresqlUpgrade postgresql-private-develUpgrade pgvectorUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-test-rpm-macrosUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgresql-plpython3Upgrade postgresql-plperl | Jan 20, 2026 | Jan 13, 2026 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql17Upgrade postgresql18Upgrade postgresql16 | Nov 17, 2025 | Nov 13, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-plperlUpgrade postgresql-llvmjitUpgrade postgresql-contribUpgrade postgresql-test-rpm-macrosUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresql-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-docsUpgrade postgresql-upgradeUpgrade postgresql-test | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-upgrade-develUpgrade postgresql17-plperlUpgrade postgresql15-upgrade-develUpgrade postgresql15-plperlUpgrade postgresql17-plperl-debuginfoUpgrade postgresql17-upgradeUpgrade postgresql16-llvmjitUpgrade postgresql16-testUpgrade postgresql17-test-rpm-macrosUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-test-debuginfoUpgrade postgresql16-serverUpgrade postgresql15-serverUpgrade postgresql17-contribUpgrade postgresql17-plpython3Upgrade postgresql17-docsUpgrade postgresql15-test-rpm-macrosUpgrade postgresql15-plpython3Upgrade postgresql17-docs-debuginfoUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql16Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql17Upgrade postgresql16-plpython3Upgrade postgresql15-llvmjitUpgrade postgresql17-upgrade-debuginfoUpgrade postgresql17-llvmjitUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-private-libsUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-pltclUpgrade postgresql16-upgrade-develUpgrade postgresql16-contribUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql17-staticUpgrade postgresql17-private-develUpgrade postgresql17-pltclUpgrade postgresql16-upgradeUpgrade postgresql16-debugsourceUpgrade postgresql15-plperl-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql17-testUpgrade postgresql15-docs-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql17-debuginfoUpgrade postgresql16-private-develUpgrade postgresql16-plperlUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql15-contribUpgrade postgresql16-server-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql15-debuginfoUpgrade postgresql17-serverUpgrade postgresql16-pltclUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-server-develUpgrade postgresql16-plperl-debuginfoUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql17-debugsourceUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql15-private-develUpgrade postgresql17-server-develUpgrade postgresql17-contrib-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql16-contrib-debuginfoUpgrade postgresql15-testUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-upgradeUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql15-static | Dec 9, 2025 | Nov 13, 2025 |
| Debian | — | Upgrade postgresql-17Upgrade postgresql-13Upgrade postgresql-15 | Dec 29, 2025 | Dec 29, 2025 |
| Freebsd | — | Upgrade postgresql18-clientUpgrade postgresql14-clientUpgrade postgresql15-clientUpgrade postgresql16-clientUpgrade postgresql13-clientUpgrade postgresql17-client | Dec 10, 2025 | Nov 14, 2025 |
| Gentoo Linux | — | Upgrade dev-db/postgresql. | Aug 17, 2026 | Aug 17, 2026 |
| Ibm Aix | — | Apply the fix or workaround for aix_vios_advisory | Aug 16, 2026 | Aug 14, 2026 |
| Oracle_linux | — | Upgrade postgresql-plpython3Upgrade pgvectorUpgrade postgresql-test-rpm-macrosUpgrade postgis-upgradeUpgrade postgresql-upgradeUpgrade postgresql-contribUpgrade postgresql-upgrade-develUpgrade postgisUpgrade postgresql-docsUpgrade postgis-docsUpgrade pg_repackUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresql-private-libsUpgrade postgresql-server-develUpgrade postgis-utilsUpgrade postgresql-staticUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql-serverUpgrade postgres-decoderbufsUpgrade postgresql-testUpgrade postgresql-plperlUpgrade postgis-client | Jan 15, 2026 | Nov 13, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 18.1Upgrade to PostgreSQL version 15.15Upgrade to PostgreSQL version 14.20Upgrade to PostgreSQL version 16.11Upgrade to PostgreSQL version 17.7 | Nov 14, 2025 | Nov 13, 2025 |
| Redhat_linux | — | Upgrade postgis-debuginfoUpgrade pgvectorUpgrade postgresql16-debugsourceUpgrade pg_repackUpgrade postgresql-docs-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgis-client-debuginfoUpgrade postgresql-plpython3Upgrade pg_repack-debuginfoUpgrade postgis-utilsUpgrade postgresql-test-rpm-macrosUpgrade postgresql-plperlUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-pltclUpgrade postgis-upgrade-debuginfoUpgrade pgvector-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-upgrade-debuginfoUpgrade postgis-debugsourceUpgrade postgresql-server-develUpgrade postgresql-debuginfoUpgrade postgresql-serverUpgrade pgaudit-debugsourceUpgrade postgresql-contribUpgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-private-develNo solution existsUpgrade postgresql-docsUpgrade postgresql-upgrade-develUpgrade postgresql16-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgis-upgradeUpgrade postgis-clientUpgrade postgresql-test-debuginfoUpgrade postgresql-testUpgrade pgvector-debugsourceUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgresqlUpgrade postgresql-private-libsUpgrade postgresql-upgradeUpgrade postgres-decoderbufsUpgrade postgresql-staticUpgrade postgisUpgrade postgis-docsUpgrade postgres-decoderbufs-debuginfo | Dec 5, 2025 | Nov 13, 2025 |
| Rocky_linux | — | Upgrade postgis-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade pg_repackUpgrade pgaudit-debugsourceUpgrade postgresqlUpgrade postgresql-upgrade-debuginfoUpgrade pgvectorUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docsUpgrade postgresql-staticUpgrade postgis-upgradeUpgrade postgresql-serverUpgrade postgis-upgrade-debuginfoUpgrade postgis-clientUpgrade postgis-debuginfoUpgrade postgresql-plperlUpgrade postgis-client-debuginfoUpgrade postgresql-private-develUpgrade postgresql-contribUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-pltclUpgrade postgresql-test-debuginfoUpgrade postgresql-plpython3-debuginfoUpgrade pgaudit-debuginfoUpgrade postgresql-private-libsUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgresql-docs-debuginfoUpgrade postgresql-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgisUpgrade pgvector-debuginfoUpgrade pgauditUpgrade postgresql-testUpgrade postgis-utilsUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-server-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql-pltcl-debuginfoUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufsUpgrade postgis-docs | Jan 16, 2026 | Jan 14, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 10.0.5Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 9.3.11Upgrade Splunk Enterprise to version 10.2.2 | Jul 30, 2026 | Nov 13, 2025 |
| Ubuntu | — | Upgrade postgresql-17Upgrade postgresql-14Upgrade postgresql-16 | Dec 5, 2025 | Dec 3, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub