CVE-2026-120060

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120060", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-30T19:25:18.919Z", "datePublished": "2026-11-02T19:09:10.912Z", "dateUpdated": "2026-11-02T19:43:04.278Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:10.912Z"}, "title": "psqlODBC does not validate server-supplied counts and lengths", "datePublic": "2026-11-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected."}], "affected": [{"vendor": "PostgreSQL", "product": "psqlODBC", "repo": "https://github.com/postgresql-interfaces/psqlodbc", "programFiles": ["pgapi30.c", "results.c", "info.c", "convert.c"], "programRoutines": [{"name": "PGAPI_BulkOperations"}, {"name": "SC_fetch_by_bookmark"}, {"name": "PGAPI_Statistics"}, {"name": "convert_from_pgbinary"}], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "18.00.0006", "status": "affected", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting."}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. The row count, the index-key count, and the octal escape length are checked before use."}], "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877", "tags": ["vendor-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120060", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:21:21.052088Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:43:04.278Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120060", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:21:21.052088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:34:53.453Z"}}], "cna": {"title": "psqlODBC does not validate server-supplied counts and lengths", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "product": "psqlODBC", "versions": [{"status": "affected", "version": "0", "lessThan": "18.00.0006", "versionType": "custom"}], "programFiles": ["pgapi30.c", "results.c", "info.c", "convert.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "PGAPI_BulkOperations"}, {"name": "SC_fetch_by_bookmark"}, {"name": "PGAPI_Statistics"}, {"name": "convert_from_pgbinary"}]}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. The row count, the index-key count, and the octal escape length are checked before use."}], "datePublic": "2026-11-02T00:00:00.000Z", "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting."}], "descriptions": [{"lang": "en", "value": "psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:10.912Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120060", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:43:04.278Z", "dateReserved": "2026-10-30T19:25:18.919Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-11-02T19:09:10.912Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "psqlODBC", "programFiles": ["pgapi30.c", "results.c", "info.c", "convert.c"], "programRoutines": [{"name": "PGAPI_BulkOperations"}, {"name": "SC_fetch_by_bookmark"}, {"name": "PGAPI_Statistics"}, {"name": "convert_from_pgbinary"}], "repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "versions": [{"lessThan": "18.00.0006", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected."}], "id": "CVE-2026-120060", "lastModified": "2026-11-02T20:17:39.190", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120060", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:21:21.052088Z", "version": "2.0.3"}}]}, "published": "2026-11-02T19:18:03.137", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-191"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "psqlodbc: psqlodbc: Denial of Service (DoS) via untrusted server responses", "id": "2565365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565365"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H", "status": "draft"}, "cwe": "CWE-125", "details": ["psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.", "A flaw was found in psqlODBC. The driver improperly validates lengths and counts received from the database server across multiple data handling operations. A malicious or compromised server can exploit this vulnerability by returning crafted responses to a connecting client. Successful exploitation can result in a Denial of Service (DoS) by crashing the client application, or lead to an out-of-bounds memory read."], "name": "CVE-2026-120060", "public_date": "2026-11-02T19:09:10Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120060\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120060\nhttps://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877"], "statement": "This vulnerability is rated as having Moderate impact for Red Hat products because exploitation requires a client application to connect to a malicious or compromised database server, or an untrusted endpoint over an unverified connection. In standard enterprise environments, applications utilizing psqlODBC connect strictly to managed, authenticated database infrastructure, restricting untrusted exposure. Furthermore, the maximum blast radius is limited to client-side process termination or out-of-bounds memory reading, with no capability for remote code execution or modification of system data.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.00.0006)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "psqlODBC", "source": "cna", "vendor": "PostgreSQL"}, "product": "psqlodbc", "vendor": "postgresql"}], "created": "2026-11-02T20:45:07.021598+00:00", "updated": "2026-11-02T20:45:07.598328+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$psqlodbc"]}