PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
CVSS Details
- CVSS 4.0 Base Score: 7.2 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade pgvector-debuginfoUpgrade postgresql18-postgis-client-debuginfoUpgrade postgresql18-postgis-debugsourceUpgrade pg_repack-debuginfoUpgrade postgresql-upgradeUpgrade postgresql18-postgis-docsUpgrade pgvector-debugsourceUpgrade pg_repack-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-debugsourceUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgisUpgrade postgis-docsUpgrade postgresql18-postgis-debuginfoUpgrade postgis-utilsUpgrade postgresql-private-libsUpgrade postgresql-docs-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql-pltcl-debuginfoUpgrade postgresql16-postgis-debugsourceUpgrade postgresql-server-develUpgrade pgaudit-debuginfoUpgrade postgresql-plpython3Upgrade postgresql-server-devel-debuginfoUpgrade postgres-decoderbufs-debugsourceUpgrade postgresql-plpython3-debuginfoUpgrade postgis-upgradeUpgrade postgresql16-postgis-debuginfoUpgrade postgresql-upgrade-debuginfoUpgrade postgresql18-postgis-utilsUpgrade postgresql-staticUpgrade postgresql-serverUpgrade postgresqlUpgrade pgaudit-debugsourceUpgrade postgresql-plperl-debuginfoUpgrade postgis-client-debuginfoUpgrade postgresql18-postgisUpgrade postgresql-test-debuginfoUpgrade postgresql-server-debuginfoUpgrade postgresql-private-develUpgrade postgresql-pltclUpgrade postgresql18-postgis-clientUpgrade postgresql-debuginfoUpgrade postgresql-contribUpgrade pgvectorUpgrade postgis-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade postgresql-docsUpgrade pgauditUpgrade postgresql-plperlUpgrade postgresql-testUpgrade postgis-upgrade-debuginfoUpgrade postgis-debugsourceUpgrade postgresql18-postgis-upgradeUpgrade postgresql-test-rpm-macrosUpgrade pg_repackUpgrade postgresql18-postgis-upgrade-debuginfoUpgrade postgis-client | Aug 17, 2026 | Aug 13, 2026 |
| Rocky_linux | — | Upgrade postgresql-docsUpgrade postgresql-debuginfoUpgrade postgresql-plperl-debuginfoUpgrade pgauditUpgrade postgresql-private-develUpgrade postgresqlUpgrade postgresql-pltclUpgrade postgresql18-postgis-utilsUpgrade postgresql-plperlUpgrade postgresql-testUpgrade pgaudit-debugsourceUpgrade postgis-upgrade-debuginfoUpgrade postgis-clientUpgrade postgresql-upgrade-debuginfoUpgrade postgis-client-debuginfoUpgrade postgresql-private-libsUpgrade postgresql18-postgis-upgrade-debuginfoUpgrade postgresql18-postgis-upgradeUpgrade postgresql-staticUpgrade postgresql-server-debuginfoUpgrade postgres-decoderbufs-debuginfoUpgrade pgvector-debuginfoUpgrade pg_repackUpgrade pgvectorUpgrade postgresql-serverUpgrade postgresql16-postgis-debuginfoUpgrade postgresql-upgradeUpgrade postgresql-pltcl-debuginfoUpgrade postgisUpgrade postgresql18-postgis-docsUpgrade pg_repack-debugsourceUpgrade postgresql-private-libs-debuginfoUpgrade postgresql-test-debuginfoUpgrade postgresql-server-devel-debuginfoUpgrade postgresql-docs-debuginfoUpgrade postgis-debuginfoUpgrade postgresql-plpython3Upgrade postgresql18-postgis-debuginfoUpgrade postgresql-server-develUpgrade postgresql-plpython3-debuginfoUpgrade postgresql-upgrade-devel-debuginfoUpgrade postgres-decoderbufsUpgrade postgresql18-postgis-debugsourceUpgrade postgresql18-postgis-client-debuginfoUpgrade postgresql18-postgisUpgrade postgis-utilsUpgrade postgresql-debugsourceUpgrade postgres-decoderbufs-debugsourceUpgrade postgis-docsUpgrade pgvector-debugsourceUpgrade postgresql18-postgis-clientUpgrade postgresql16-postgis-debugsourceUpgrade postgresql-upgrade-develUpgrade postgresql-contribUpgrade pgaudit-debuginfoUpgrade postgresql-contrib-debuginfoUpgrade postgis-upgradeUpgrade pg_repack-debuginfoUpgrade postgis-debugsource | Sep 15, 2026 | Sep 10, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub