CVE-2025-12818

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12818", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2025-11-06T17:22:32.130Z", "datePublished": "2025-11-13T13:00:12.911Z", "dateUpdated": "2025-11-13T13:59:33.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2025-11-13T13:00:12.911Z"}, "title": "PostgreSQL libpq undersizes allocations, via integer wraparound", "descriptions": [{"lang": "en", "value": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."}], "affected": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.1", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.7", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.11", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.15", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.20", "status": "affected", "version": "14", "versionType": "rpm"}, {"lessThan": "13.23", "status": "affected", "version": "0", "versionType": "rpm"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-190", "type": "CWE", "description": "Integer Overflow or Wraparound"}]}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2025-12818/"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Aleksey Solovev (Positive Technologies) for reporting this problem."}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-13T13:59:26.597610Z", "id": "CVE-2025-12818", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T13:59:33.436Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12818", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-13T13:59:26.597610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-13T13:59:31.006Z"}}], "cna": {"title": "PostgreSQL libpq undersizes allocations, via integer wraparound", "credits": [{"lang": "en", "value": "The PostgreSQL project thanks Aleksey Solovev (Positive Technologies) for reporting this problem."}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "affected": [{"vendor": "n/a", "product": "PostgreSQL", "versions": [{"status": "affected", "version": "18", "lessThan": "18.1", "versionType": "rpm"}, {"status": "affected", "version": "17", "lessThan": "17.7", "versionType": "rpm"}, {"status": "affected", "version": "16", "lessThan": "16.11", "versionType": "rpm"}, {"status": "affected", "version": "15", "lessThan": "15.15", "versionType": "rpm"}, {"status": "affected", "version": "14", "lessThan": "14.20", "versionType": "rpm"}, {"status": "affected", "version": "0", "lessThan": "13.23", "versionType": "rpm"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.postgresql.org/support/security/CVE-2025-12818/"}], "descriptions": [{"lang": "en", "value": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2025-11-13T13:00:12.911Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12818", "state": "PUBLISHED", "dateUpdated": "2025-11-13T13:59:33.436Z", "dateReserved": "2025-11-06T17:22:32.130Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2025-11-13T13:00:12.911Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PostgreSQL", "vendor": "n/a", "versions": [{"lessThan": "18.1", "status": "affected", "version": "18", "versionType": "rpm"}, {"lessThan": "17.7", "status": "affected", "version": "17", "versionType": "rpm"}, {"lessThan": "16.11", "status": "affected", "version": "16", "versionType": "rpm"}, {"lessThan": "15.15", "status": "affected", "version": "15", "versionType": "rpm"}, {"lessThan": "14.20", "status": "affected", "version": "14", "versionType": "rpm"}, {"lessThan": "13.23", "status": "affected", "version": "0", "versionType": "rpm"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected."}, {"lang": "es", "value": "El desbordamiento de enteros en m\u00faltiples funciones de la biblioteca cliente libpq de PostgreSQL permite que un proveedor de entrada de aplicaci\u00f3n o un par de red provoque que libpq asigne un tama\u00f1o insuficiente y escriba fuera de los l\u00edmites por cientos de megabytes. Esto resulta en un fallo de segmentaci\u00f3n para la aplicaci\u00f3n que utiliza libpq. Las versiones anteriores a PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20 y 13.23 est\u00e1n afectadas."}], "id": "CVE-2025-12818", "lastModified": "2026-10-19T13:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12818", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-13T13:59:26.597610Z", "version": "2.0.3"}}]}, "published": "2025-11-13T13:15:45.313", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://www.postgresql.org/support/security/CVE-2025-12818/"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "postgresql: libpq undersizes allocations, via integer wraparound", "id": "2414826", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414826"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-190", "details": ["Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes. This results in a segmentation fault for the application using libpq. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.", "A vulnerability has been identified in PostgreSQL\u2019s libpq client library, where integer wraparound in several allocation-size calculations allows a peer or input provider to cause an undersized buffer and then write out-of-bounds by hundreds of megabytes. This can lead to a client application segmentation fault or crash when using libpq to connect to a PostgreSQL server."], "mitigation": {"lang": "en:us", "value": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability."}, "name": "CVE-2025-12818", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "postgresql16", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Under investigation", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "postgresql:12/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:13/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql:15/postgresql", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "postgresql:16/postgresql", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-11-13T13:00:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-12818\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-12818\nhttps://www.postgresql.org/support/security/CVE-2025-12818/"], "statement": "This issue is rated Moderate severity by Red Hat Product Security, even though it carries a High CVSS v3.1 score. The flaw resides in the libpq client library and can be triggered when a client receives specially crafted PostgreSQL protocol data that causes an integer wraparound and an out-of-bounds write. The attack complexity is Low because the malformed protocol message is processed immediately during connection, with no timing or environmental conditions required. However, the impact is limited to a denial of service of the client application only. As a result, Red Hat classifies the overall product impact as Moderate, reflecting that the flaw can interrupt client availability.", "threat_severity": "Moderate"}

{"created": "2025-11-14T09:28:02.140516+00:00", "updated": "2025-11-14T09:28:02.140542+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$postgresql"]}