Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
CVSS Details
- CVSS 3.1 Base Score: 3.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade postgresql-plperlUpgrade postgresql-plpython3Upgrade postgres-decoderbufsUpgrade postgis-clientUpgrade postgresql-server-develUpgrade postgresql-private-develUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-testUpgrade postgis-docsUpgrade postgresql-upgradeUpgrade pgvectorUpgrade postgis-utilsUpgrade pg_repackUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgis-upgradeUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgisUpgrade postgresql-docsUpgrade postgresql-upgrade-devel | Jan 20, 2026 | Jan 13, 2026 |
| Alpine Linux | — | Upgrade postgresql15Upgrade postgresql17Upgrade postgresql18Upgrade postgresql16 | Nov 17, 2025 | Nov 13, 2025 |
| Amazon Linux Ami 2 | — | Upgrade postgresql-upgradeUpgrade postgresql-staticUpgrade postgresql-upgrade-develUpgrade postgresql-testUpgrade postgresql-docsUpgrade postgresql-plperlUpgrade postgresql-server-develUpgrade postgresql-contribUpgrade postgresql-debuginfoUpgrade postgresql-plpython3Upgrade postgresqlUpgrade postgresql-test-rpm-macrosUpgrade postgresql-llvmjitUpgrade postgresql-pltclUpgrade postgresql-server | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade postgresql16-pltclUpgrade postgresql16-test-rpm-macrosUpgrade postgresql16-debuginfoUpgrade postgresql17-upgrade-develUpgrade postgresql15-llvmjit-debuginfoUpgrade postgresql16-server-develUpgrade postgresql15-upgrade-develUpgrade postgresql16-llvmjitUpgrade postgresql17-plperlUpgrade postgresql17-debugsourceUpgrade postgresql15-testUpgrade postgresql17-pltcl-debuginfoUpgrade postgresql17-test-debuginfoUpgrade postgresql16-contrib-debuginfoUpgrade postgresql16-docsUpgrade postgresql15-test-debuginfoUpgrade postgresql16-docs-debuginfoUpgrade postgresql15-private-libsUpgrade postgresql15-contrib-debuginfoUpgrade postgresql15-private-develUpgrade postgresql17-contrib-debuginfoUpgrade postgresql17-upgradeUpgrade postgresql15-plperlUpgrade postgresql17-llvmjit-debuginfoUpgrade postgresql17-plperl-debuginfoUpgrade postgresql17-plpython3-debuginfoUpgrade postgresql17-server-develUpgrade postgresql16-plperl-debuginfoUpgrade postgresql15-server-devel-debuginfoUpgrade postgresql17-server-debuginfoUpgrade postgresql15-docsUpgrade postgresql15Upgrade postgresql16-test-debuginfoUpgrade postgresql17-test-rpm-macrosUpgrade postgresql15-upgradeUpgrade postgresql15-plpython3-debuginfoUpgrade postgresql16-server-devel-debuginfoUpgrade postgresql16-testUpgrade postgresql15-pltcl-debuginfoUpgrade postgresql15-server-develUpgrade postgresql17-private-libsUpgrade postgresql16-staticUpgrade postgresql15-staticUpgrade postgresql16-plpython3-debuginfoUpgrade postgresql16-pltcl-debuginfoUpgrade postgresql17-upgrade-devel-debuginfoUpgrade postgresql15-plperl-debuginfoUpgrade postgresql16-debugsourceUpgrade postgresql16-upgradeUpgrade postgresql17-plpython3Upgrade postgresql17-upgrade-debuginfoUpgrade postgresql17-serverUpgrade postgresql16-upgrade-devel-debuginfoUpgrade postgresql16-contribUpgrade postgresql17-private-develUpgrade postgresql16-private-libs-debuginfoUpgrade postgresql17-pltclUpgrade postgresql17-staticUpgrade postgresql16-serverUpgrade postgresql15-test-rpm-macrosUpgrade postgresql16-upgrade-develUpgrade postgresql15-contribUpgrade postgresql17-debuginfoUpgrade postgresql16-private-develUpgrade postgresql16-plperlUpgrade postgresql16-llvmjit-debuginfoUpgrade postgresql15-server-debuginfoUpgrade postgresql15-private-libs-debuginfoUpgrade postgresql15-debugsourceUpgrade postgresql17-private-libs-debuginfoUpgrade postgresql16-server-debuginfoUpgrade postgresql16Upgrade postgresql17Upgrade postgresql16-plpython3Upgrade postgresql15-upgrade-devel-debuginfoUpgrade postgresql17-testUpgrade postgresql15-docs-debuginfoUpgrade postgresql17-contribUpgrade postgresql17-server-devel-debuginfoUpgrade postgresql17-docsUpgrade postgresql17-docs-debuginfoUpgrade postgresql15-plpython3Upgrade postgresql15-debuginfoUpgrade postgresql15-serverUpgrade postgresql15-upgrade-debuginfoUpgrade postgresql15-pltclUpgrade postgresql17-llvmjitUpgrade postgresql16-upgrade-debuginfoUpgrade postgresql16-private-libsUpgrade postgresql15-llvmjit | Dec 9, 2025 | Nov 13, 2025 |
| Debian | — | Upgrade postgresql-13Upgrade postgresql-15Upgrade postgresql-17 | Dec 29, 2025 | Dec 29, 2025 |
| Freebsd | — | Upgrade postgresql18-clientUpgrade postgresql14-clientUpgrade postgresql15-clientUpgrade postgresql16-clientUpgrade postgresql13-clientUpgrade postgresql17-client | Dec 10, 2025 | Nov 14, 2025 |
| Oracle_linux | — | Upgrade pgvectorUpgrade postgis-upgradeUpgrade postgresql-upgradeUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade postgresql-plpython3Upgrade postgisUpgrade postgresql-docsUpgrade postgresql-test-rpm-macrosUpgrade postgis-utilsUpgrade postgresql-serverUpgrade postgresql-pltclUpgrade postgresqlUpgrade postgresql-testUpgrade postgis-docsUpgrade postgresql-server-develUpgrade postgresql-plperlUpgrade postgres-decoderbufsUpgrade postgis-clientUpgrade postgresql-private-develUpgrade postgresql-private-libsUpgrade pgauditUpgrade postgresql-staticUpgrade pg_repack | Jan 15, 2026 | Nov 13, 2025 |
| Postgres | — | Upgrade to PostgreSQL version 18.1Upgrade to the latest version of PostgreSQLUpgrade to PostgreSQL version 16.11Upgrade to PostgreSQL version 14.20Upgrade to PostgreSQL version 17.7Upgrade to PostgreSQL version 15.15 | Nov 14, 2025 | Nov 13, 2025 |
| Redhat_linux | — | Upgrade pg_repack-debugsourceUpgrade pgauditUpgrade postgresql-server-debuginfoUpgrade postgresql-staticUpgrade postgresql-upgradeUpgrade postgresql-private-develUpgrade postgresql-docsUpgrade postgresql-testUpgrade postgresql-contrib-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgis-clientUpgrade postgres-decoderbufsUpgrade postgresql16-debuginfoUpgrade postgresqlUpgrade postgres-decoderbufs-debuginfoUpgrade postgisUpgrade postgresql-pltcl-debuginfoUpgrade postgis-docsUpgrade postgresql-upgrade-develUpgrade postgresql-debugsourceUpgrade postgresql-private-libsUpgrade pgvector-debugsourceUpgrade postgis-upgradeUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-server-devel-debuginfoNo solution existsUpgrade postgis-debuginfoUpgrade pgvectorUpgrade postgresql-server-develUpgrade postgresql-plpython3Upgrade postgresql-plperlUpgrade pgaudit-debuginfoUpgrade pg_repack-debuginfoUpgrade postgresql-pltclUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgis-client-debuginfoUpgrade postgresql16-debugsourceUpgrade postgis-utilsUpgrade pg_repackUpgrade postgresql-test-rpm-macrosUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade pgaudit-debugsourceUpgrade postgis-upgrade-debuginfoUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-serverUpgrade pgvector-debuginfoUpgrade postgis-debugsourceUpgrade postgresql-upgrade-debuginfo | Dec 5, 2025 | Nov 13, 2025 |
| Rocky_linux | — | Upgrade postgis-clientUpgrade postgis-debuginfoUpgrade postgresql-pltclUpgrade postgresql-plperl-debuginfoUpgrade postgresql-serverUpgrade postgresql-upgrade-debuginfoUpgrade postgresql-staticUpgrade postgresql-contribUpgrade postgresql-private-develUpgrade postgresql-plperlUpgrade postgis-upgradeUpgrade pg_repackUpgrade postgis-debugsourceUpgrade postgresql-docsUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgis-client-debuginfoUpgrade pgaudit-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade pgvectorUpgrade postgresqlUpgrade postgis-upgrade-debuginfoUpgrade postgis-docsUpgrade postgresql-upgradeUpgrade postgresql-server-devel-debuginfoUpgrade postgis-utilsUpgrade postgresql-test-debuginfoUpgrade postgresql-server-debuginfoUpgrade pgvector-debugsourceUpgrade postgresql-plpython3Upgrade postgresql-debugsourceUpgrade postgres-decoderbufsUpgrade postgresql-upgrade-develUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-pltcl-debuginfoUpgrade postgresql-debuginfoUpgrade pgvector-debuginfoUpgrade pgauditUpgrade postgresql-private-libsUpgrade postgresql-docs-debuginfoUpgrade pg_repack-debugsourceUpgrade pg_repack-debuginfoUpgrade pgaudit-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgisUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-testUpgrade postgresql-server-develUpgrade postgresql-contrib-debuginfo | Jan 16, 2026 | Jan 14, 2026 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.11Upgrade Splunk Enterprise to version 10.2.2Upgrade Splunk Enterprise to version 9.4.10Upgrade Splunk Enterprise to version 10.0.5 | Jul 30, 2026 | Nov 13, 2025 |
| Ubuntu | — | Upgrade postgresql-17Upgrade postgresql-14Upgrade postgresql-16 | Dec 5, 2025 | Dec 3, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Feb 9, 2026 | Nov 13, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub