Address Standardizer CVEs and Security Vulnerabilities

CVE-2026-90775

PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Postgis

Products

Address Standardizer

CVE-2026-73514

PostGIS address_standardizer Out-of-Bounds Write via standardize_address()

The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious rules table entry with an oversized rule type value that is used without bounds checking as an index into an internal output-link table, resulting in an out-of-bounds write.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed