PT-2025-20383 · Postgresql+11 · Postgresql+12
Alan Coopersmith
·
Published
2025-05-07
·
Updated
2026-04-02
·
CVE-2025-4207
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
PostgreSQL versions prior to 17.5, 16.9, 15.13, 14.18, and 13.21
Description
The vulnerability is related to a buffer over-read in PostgreSQL's GB18030 encoding validation. This issue allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. The vulnerability affects the database server and also libpq. An attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service.
Recommendations
To resolve the issue, update to the latest patched version of PostgreSQL, which includes versions 17.5, 16.9, 15.13, 14.18, and 13.21. Specifically:
- For versions prior to 17.5, update to version 17.5 or later.
- For versions prior to 16.9, update to version 16.9 or later.
- For versions prior to 15.13, update to version 15.13 or later.
- For versions prior to 14.18, update to version 14.18 or later.
- For versions prior to 13.21, update to version 13.21 or later.
Fix
DoS
Buffer Over-read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Debian
Linuxmint
Postgresql
Red Hat
Red Os
Suse
Ubuntu
Zvirt Node
Libpq