CVE-2026-120063

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120063", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "state": "PUBLISHED", "assignerShortName": "PostgreSQL", "dateReserved": "2026-10-30T19:25:18.920Z", "datePublished": "2026-11-02T19:09:12.867Z", "dateUpdated": "2026-11-02T19:36:16.948Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:12.867Z"}, "title": "psqlODBC stack buffer overflow when quoting long schema and table names", "datePublic": "2026-11-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected."}], "affected": [{"vendor": "PostgreSQL", "product": "psqlODBC", "repo": "https://github.com/postgresql-interfaces/psqlodbc", "programFiles": ["info.c", "convert.c", "parse.c"], "programRoutines": [{"name": "identifierEscape"}, {"name": "inner_process_tokens"}, {"name": "getCOLIfromTable"}], "defaultStatus": "unaffected", "versions": [{"version": "0", "lessThan": "18.00.0006", "status": "affected", "versionType": "custom"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}}], "workarounds": [{"lang": "en", "value": "Do not pass SQL text from untrusted sources to the driver."}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. identifierEscape bounds every write to the output buffer, including the closing quote and the terminator."}], "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv", "tags": ["vendor-advisory"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T19:36:05.190717Z", "id": "CVE-2026-120063", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:36:16.948Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-120063", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T19:36:05.190717Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T19:36:11.202Z"}}], "cna": {"title": "psqlODBC stack buffer overflow when quoting long schema and table names", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "product": "psqlODBC", "versions": [{"status": "affected", "version": "0", "lessThan": "18.00.0006", "versionType": "custom"}], "programFiles": ["info.c", "convert.c", "parse.c"], "defaultStatus": "unaffected", "programRoutines": [{"name": "identifierEscape"}, {"name": "inner_process_tokens"}, {"name": "getCOLIfromTable"}]}], "solutions": [{"lang": "en", "value": "Upgrade to psqlODBC 18.00.0006 or later. identifierEscape bounds every write to the output buffer, including the closing quote and the terminator."}], "datePublic": "2026-11-02T00:00:00.000Z", "references": [{"url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Do not pass SQL text from untrusted sources to the driver."}], "descriptions": [{"lang": "en", "value": "When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121 Stack-based Buffer Overflow"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "shortName": "PostgreSQL", "dateUpdated": "2026-11-02T19:09:12.867Z"}}}, "cveMetadata": {"cveId": "CVE-2026-120063", "state": "PUBLISHED", "dateUpdated": "2026-11-02T19:36:16.948Z", "dateReserved": "2026-10-30T19:25:18.920Z", "assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "datePublished": "2026-11-02T19:09:12.867Z", "assignerShortName": "PostgreSQL"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "psqlODBC", "programFiles": ["info.c", "convert.c", "parse.c"], "programRoutines": [{"name": "identifierEscape"}, {"name": "inner_process_tokens"}, {"name": "getCOLIfromTable"}], "repo": "https://github.com/postgresql-interfaces/psqlodbc", "vendor": "PostgreSQL", "versions": [{"lessThan": "18.00.0006", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected."}], "id": "CVE-2026-120063", "lastModified": "2026-11-02T20:17:39.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 4.2, "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-120063", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T19:36:05.190717Z", "version": "2.0.3"}}]}, "published": "2026-11-02T19:18:03.557", "references": [{"source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "url": "https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv"}], "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-121"}, {"lang": "en", "value": "CWE-787"}], "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007", "type": "Secondary"}]}

{"bugzilla": {"description": "psqlodbc: psqlODBC: Denial of Service via stack buffer overflow in identifier quoting", "id": "2565353", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565353"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target of the last INSERT when the driver rewrites SELECT @@IDENTITY. In the @@IDENTITY rewrite, a column name sent by the server can also write one byte past the buffer. The bytes written past the buffer are a double quote and a NUL. An application that forwards untrusted SQL text to the driver exposes its process to stack corruption. Versions before psqlODBC 18.00.0006 are affected.", "A flaw was found in psqlODBC. This vulnerability allows an attacker to cause a Denial of Service (DoS) by crashing the host application. When processing SQL queries with excessively long table or schema names, or crafted column names returned by a database server, the driver fails to properly validate buffer boundaries during identifier quoting. This flaw triggers a stack-based buffer overflow, causing memory corruption that disrupts application availability."], "name": "CVE-2026-120063", "public_date": "2026-11-02T19:09:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120063\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120063\nhttps://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-285r-84w3-xcxv"], "statement": "Red Hat Product Security rates this vulnerability as Moderate because exploitation requires an application using the driver to forward untrusted SQL statements or connect to an adversarial database instance. The boundary error allows a small out-of-bounds write of up to two bytes on the stack, which typically results in process termination (Denial of Service) rather than arbitrary code execution on hardened systems. In standard deployments, client applications generally execute predetermined queries against authenticated, trusted database backends, restricting exposure.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,18.00.0006)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "psqlODBC", "source": "cna", "vendor": "PostgreSQL"}, "product": "psqlodbc", "vendor": "postgresql"}], "created": "2026-11-02T20:45:07.021111+00:00", "updated": "2026-11-02T20:45:07.597635+00:00", "vendors": ["postgresql", "postgresql$PRODUCT$psqlodbc"]}