Input validation error in PostgreSQL - CVE-2025-1094

Vulnerability identifier: #VU103970

CSH Severity: Critical

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-1094

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to execute arbitrary SQL queries in the database.

The vulnerability exists due to insufficient validation of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() and within the command line utility programs  when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. A remote attacker can pass specially crafted input to the application and execute arbitrary SQL queries in the database.

Note, the vulnerability is being actively exploited in the wild.

PostgreSQL
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server 12 SP5
Gentoo Linux
Oracle Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
Galera for Ericsson 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Basesystem Module
Server Applications Module
SUSE Package Hub 15
Legacy Module
openSUSE Leap
Ubuntu
openEuler
SecurityCenter
Netcool Operations Insight
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Observability with Instana
APEX Cloud Platform for Red Hat OpenShift
Red Hat Advanced Cluster Security for Kubernetes
IBM Sterling Connect:Direct Web Services
PowerProtect Data Manager
IBM Qradar SIEM
RSA Authentication Manager
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
postgresql-10 (Ubuntu package)
postgresql-client-10 (Ubuntu package)
postgres-decoderbufs
pgaudit
pg_repack
dev-db/postgresql
postgresql-server
postgresql
postgresql-contrib
postgresql-devel
postgresql-docs
postgresql-libs
postgresql-plperl
postgresql-plpython
postgresql-pltcl
postgresql-test
postgresql (Red Hat package)
libpq (Red Hat package)
postgresql-client-12 (Ubuntu package)
postgresql-12 (Ubuntu package)
postgresql-plpython3
postgresql-server-devel
postgresql-upgrade
postgresql-upgrade-devel
postgresql-test-rpm-macros
postgresql-static
postgresql-debuginfo
postgresql-debugsource
postgresql-llvmjit
postgresql-private-devel
postgresql-private-libs
postgresql-13
postgresql-13-contrib
postgresql-13-debuginfo
postgresql-13-debugsource
postgresql-13-docs
postgresql-13-llvmjit
postgresql-13-plperl
postgresql-13-plpython3
postgresql-13-pltcl
postgresql-13-private-devel
postgresql-13-private-libs
postgresql-13-server
postgresql-13-server-devel
postgresql-13-static
postgresql-13-test
postgresql-13-test-rpm-macros
libpq-devel
libpq-debugsource
libpq-debuginfo
libpq
postgresql13-debugsource
postgresql13-contrib-debuginfo
postgresql13-server-debuginfo
postgresql13-plperl
postgresql13-docs
postgresql13-server-devel-debuginfo
postgresql13-server-devel
postgresql13-contrib
postgresql13-plpython-debuginfo
postgresql13-plperl-debuginfo
postgresql13-pltcl
postgresql13-devel
postgresql13-plpython
postgresql13-devel-debuginfo
postgresql13-debuginfo
postgresql13-pltcl-debuginfo
postgresql13
postgresql13-server
postgresql13-llvmjit-devel
postgresql13-llvmjit-debuginfo
postgresql13-llvmjit
postgresql13-test
postgresql-client-14 (Ubuntu package)
postgresql-14 (Ubuntu package)
postgresql14-contrib
postgresql14-plpython-debuginfo
postgresql14
postgresql14-devel
postgresql14-server-devel-debuginfo
postgresql14-server-devel
postgresql14-devel-debuginfo
postgresql14-plpython
postgresql14-debugsource
postgresql14-docs
postgresql14-plperl
postgresql14-server
postgresql14-pltcl-debuginfo
postgresql14-debuginfo
postgresql14-server-debuginfo
postgresql14-pltcl
postgresql14-contrib-debuginfo
postgresql14-plperl-debuginfo
postgresql14-llvmjit
postgresql14-llvmjit-devel
postgresql14-llvmjit-debuginfo
postgresql14-test
libpq-doc
postgresql15-debugsource
postgresql15-plpython
postgresql15-debuginfo
postgresql15-devel-debuginfo
postgresql15-plperl
postgresql15-contrib
postgresql15-devel
postgresql15-server-devel
postgresql15-contrib-debuginfo
postgresql15
postgresql15-pltcl
postgresql15-server
postgresql15-server-devel-debuginfo
postgresql15-plpython-debuginfo
postgresql15-pltcl-debuginfo
postgresql15-server-debuginfo
postgresql15-docs
postgresql15-plperl-debuginfo
postgresql15-test
postgresql15-llvmjit
postgresql15-llvmjit-devel
postgresql15-llvmjit-debuginfo
postgresql-client-16 (Ubuntu package)
postgresql-16 (Ubuntu package)
postgresql16
postgresql16-devel
postgresql16-contrib-debuginfo
postgresql16-server
postgresql16-plpython
postgresql16-server-devel
postgresql16-devel-debuginfo
postgresql16-plperl-debuginfo
postgresql16-debuginfo
postgresql16-pltcl
postgresql16-plperl
postgresql16-contrib
postgresql16-server-devel-debuginfo
postgresql16-pltcl-debuginfo
postgresql16-server-debuginfo
postgresql16-debugsource
postgresql16-plpython-debuginfo
postgresql16-docs
postgresql16-llvmjit
postgresql16-llvmjit-devel
postgresql16-test
postgresql16-llvmjit-debuginfo
libpq5-debuginfo-32bit
libecpg6-debuginfo
libpq5
libecpg6
libpq5-debuginfo
libpq5-32bit
libecpg6-debuginfo-32bit
libecpg6-32bit
postgresql17-server-debuginfo
postgresql17-server
postgresql17-debugsource
postgresql17-debuginfo
libpq5-32bit-debuginfo
postgresql17-docs
postgresql17-server-devel-debuginfo
postgresql17-plperl-debuginfo
postgresql17-plperl
postgresql17-server-devel
postgresql17-devel-debuginfo
postgresql17-devel
postgresql17
postgresql17-plpython
postgresql17-contrib
postgresql17-contrib-debuginfo
postgresql17-pltcl
postgresql17-pltcl-debuginfo
postgresql17-plpython-debuginfo
libecpg6-32bit-debuginfo
libpq5-64bit-debuginfo
libecpg6-64bit-debuginfo
libecpg6-64bit
libpq5-64bit
postgresql17-llvmjit-devel
postgresql17-llvmjit
postgresql17-test
postgresql17-llvmjit-debuginfo
postgresql17-devel-mini-debuginfo
postgresql17-mini-debugsource
postgresql17-devel-mini
IBM API Connect
APEX Cloud Platform for Microsoft Azure
Red Hat OpenShift Container Platform
Juniper Secure Analytics (JSA)

Install update from vendor's website.

PostgreSQL - addressed in versions 13.19, 14.16, 15.11, 16.7, 17.3
SecurityCenter - update to SC-202504.3
Netcool Operations Insight - update to 1.6.15
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 5.2.2
IBM Qradar SIEM - update to 7.5.0 Update Pack 11 IF03
RSA Authentication Manager - update to 8.8 Patch 1
IBM API Connect - update to 10.0.8.2 ifix2
postgresql-10 (Ubuntu package) - update to Ubuntu Pro
postgresql-client-10 (Ubuntu package) - update to Ubuntu Pro
postgres-decoderbufs - addressed in versions 0.10.0-2, 1.9.7-1.Final
IBM Observability with Instana - update to 1.0.293
pgaudit - addressed in versions 1.4.0-7, 1.5.0-1, 1.7.0-1
APEX Cloud Platform for Microsoft Azure - update to 01.04.01.00
pg_repack - addressed in versions 1.4.6-3, 1.4.8-1
APEX Cloud Platform for Red Hat OpenShift - update to 03.02.04.00
Red Hat Advanced Cluster Security for Kubernetes - addressed in versions 4.5.7, 4.6.0, 4.6.3
Red Hat OpenShift Container Platform - addressed in versions 4.12.74, 4.15.47
IBM Sterling Connect:Direct Web Services - update to 6.1.0.28
Juniper Secure Analytics (JSA) - update to 7.5.0 UP11 IF03
dev-db/postgresql - update to 9.0.5
postgresql-server - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-contrib - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-devel - update to 9.2.24-9
postgresql-docs - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-libs - update to 9.2.24-9
postgresql-plperl - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-plpython - update to 9.2.24-9
postgresql-pltcl - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-test - addressed in versions 9.2.24-9, 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql (Red Hat package) - addressed in versions 9.2.24-9.el7_9.3, 13.20-1.el9_0, 13.20-1.el9_2, 13.20-1.el9_4, 13.20-1.el9_5
libpq (Red Hat package) - addressed in versions 12.7-1.el8_2.2, 13.20-1.el8_4, 13.20-1.el8_6, 13.20-1.el8_8, 13.20-1.el8_10, 13.20-1.el9_0, 13.20-1.el9_2, 13.20-1.el9_4, 13.20-1.el9_5
postgresql-client-12 (Ubuntu package) - update to 12.22-0ubuntu0.20.04.2
postgresql-12 (Ubuntu package) - update to 12.22-0ubuntu0.20.04.2
postgresql-plpython3 - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-server-devel - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-upgrade - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-upgrade-devel - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-test-rpm-macros - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql-static - addressed in versions 12.22-3.0.1, 13.20-1.0.1, 15.12-1, 15.12-1.0.1
postgresql - addressed in versions 13.19-1, 15.11-1
postgresql-static - addressed in versions 13.19-1, 15.11-1
postgresql-contrib - addressed in versions 13.19-1, 15.11-1
postgresql-debuginfo - addressed in versions 13.19-1, 15.11-1
postgresql-debugsource - addressed in versions 13.19-1, 15.11-1
postgresql-docs - addressed in versions 13.19-1, 15.11-1
postgresql-llvmjit - addressed in versions 13.19-1, 15.11-1
postgresql-plperl - addressed in versions 13.19-1, 15.11-1
postgresql-plpython3 - addressed in versions 13.19-1, 15.11-1
postgresql-pltcl - addressed in versions 13.19-1, 15.11-1
postgresql-private-devel - addressed in versions 13.19-1, 15.11-1
postgresql-private-libs - addressed in versions 13.19-1, 15.11-1
postgresql-server - addressed in versions 13.19-1, 15.11-1
postgresql-server-devel - addressed in versions 13.19-1, 15.11-1
postgresql-test-rpm-macros - addressed in versions 13.19-1, 15.11-1
postgresql-test - addressed in versions 13.19-1, 15.11-1
postgresql-13 - update to 13.20-1
postgresql-13-contrib - update to 13.20-1
postgresql-13-debuginfo - update to 13.20-1
postgresql-13-debugsource - update to 13.20-1
postgresql-13-docs - update to 13.20-1
postgresql-13-llvmjit - update to 13.20-1
postgresql-13-plperl - update to 13.20-1
postgresql-13-plpython3 - update to 13.20-1
postgresql-13-pltcl - update to 13.20-1
postgresql-13-private-devel - update to 13.20-1
postgresql-13-private-libs - update to 13.20-1
postgresql-13-server - update to 13.20-1
postgresql-13-server-devel - update to 13.20-1
postgresql-13-static - update to 13.20-1
postgresql-13-test - update to 13.20-1
postgresql-13-test-rpm-macros - update to 13.20-1
libpq-devel - addressed in versions 13.20-1, 15.12-1
libpq-debugsource - addressed in versions 13.20-1, 15.12-1
libpq-debuginfo - addressed in versions 13.20-1, 15.12-1
libpq - addressed in versions 13.20-1, 15.12-1
libpq-devel - addressed in versions 13.20-1.0.1, 15.12-1
libpq - addressed in versions 13.20-1.0.1, 15.12-1
postgresql13-debugsource - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-contrib-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-server-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-plperl - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-docs - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-server-devel-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-server-devel - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-contrib - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-plpython-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-plperl-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-pltcl - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-devel - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-plpython - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-devel-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-pltcl-debuginfo - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13 - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-server - addressed in versions 13.20-3.60.1, 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-llvmjit-devel - addressed in versions 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-llvmjit-debuginfo - addressed in versions 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-llvmjit - addressed in versions 13.20-150200.5.69.1, 13.20-150600.14.5.2
postgresql13-test - update to 13.20-150600.14.5.2
postgresql-client-14 (Ubuntu package) - update to 14.17-0ubuntu0.22.04.1
postgresql-14 (Ubuntu package) - update to 14.17-0ubuntu0.22.04.1
postgresql14-contrib - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-plpython-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14 - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-devel - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-server-devel-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-server-devel - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-devel-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-plpython - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-debugsource - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-docs - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-plperl - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-server - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-pltcl-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-server-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-pltcl - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-contrib-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-plperl-debuginfo - addressed in versions 14.17-3.54.1, 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-llvmjit - addressed in versions 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-llvmjit-devel - addressed in versions 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-llvmjit-debuginfo - addressed in versions 14.17-150200.5.55.1, 14.17-150600.16.14.1
postgresql14-test - update to 14.17-150600.16.14.1
libpq-doc - update to 15.12-1
postgresql-private-libs - addressed in versions 15.12-1, 15.12-1.0.1
postgresql-private-devel - addressed in versions 15.12-1, 15.12-1.0.1
postgresql15-debugsource - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-plpython - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-devel-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-plperl - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-contrib - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-devel - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-server-devel - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-contrib-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15 - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-pltcl - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-server - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-server-devel-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-plpython-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-pltcl-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-server-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-docs - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-plperl-debuginfo - addressed in versions 15.12-3.38.1, 15.12-150200.5.38.1, 15.12-150600.16.14.1
postgresql15-test - update to 15.12-150600.16.14.1
postgresql15-llvmjit - update to 15.12-150600.16.14.1
postgresql15-llvmjit-devel - update to 15.12-150600.16.14.1
postgresql15-llvmjit-debuginfo - update to 15.12-150600.16.14.1
postgresql-client-16 (Ubuntu package) - addressed in versions 16.8-0ubuntu0.24.04.1, 16.8-0ubuntu0.24.10.1
postgresql-16 (Ubuntu package) - addressed in versions 16.8-0ubuntu0.24.04.1, 16.8-0ubuntu0.24.10.1
postgresql16 - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-devel - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-contrib-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-server - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-plpython - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-server-devel - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-devel-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-plperl-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-pltcl - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-plperl - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-contrib - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-server-devel-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-pltcl-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-server-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-debugsource - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-plpython-debuginfo - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-docs - addressed in versions 16.8-3.26.1, 16.8-150200.5.26.1, 16.8-150600.16.15.1
postgresql16-llvmjit - update to 16.8-150600.16.15.1
postgresql16-llvmjit-devel - update to 16.8-150600.16.15.1
postgresql16-test - update to 16.8-150600.16.15.1
postgresql16-llvmjit-debuginfo - update to 16.8-150600.16.15.1
libpq5-debuginfo-32bit - update to 17.4-3.10.1
libecpg6-debuginfo - addressed in versions 17.4-3.10.1, 17.4-150200.5.10.1, 17.4-150600.13.10.1
libpq5 - addressed in versions 17.4-3.10.1, 17.4-150200.5.10.1, 17.4-150600.13.10.1
libecpg6 - addressed in versions 17.4-3.10.1, 17.4-150200.5.10.1, 17.4-150600.13.10.1
libpq5-debuginfo - addressed in versions 17.4-3.10.1, 17.4-150200.5.10.1, 17.4-150600.13.10.1
libpq5-32bit - addressed in versions 17.4-3.10.1, 17.4-150200.5.10.1, 17.4-150600.13.10.1
libecpg6-debuginfo-32bit - update to 17.4-3.10.1
libecpg6-32bit - addressed in versions 17.4-3.10.1, 17.4-150600.13.10.1
postgresql17-server-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-server - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-debugsource - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
libpq5-32bit-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-docs - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-server-devel-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-plperl-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-plperl - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-server-devel - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-devel-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-devel - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17 - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-plpython - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-contrib - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-contrib-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-pltcl - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-pltcl-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
postgresql17-plpython-debuginfo - addressed in versions 17.4-150200.5.10.1, 17.4-150600.13.10.1
libecpg6-32bit-debuginfo - update to 17.4-150600.13.10.1
libpq5-64bit-debuginfo - update to 17.4-150600.13.10.1
libecpg6-64bit-debuginfo - update to 17.4-150600.13.10.1
libecpg6-64bit - update to 17.4-150600.13.10.1
libpq5-64bit - update to 17.4-150600.13.10.1
postgresql17-llvmjit-devel - update to 17.4-150600.13.10.1
postgresql17-llvmjit - update to 17.4-150600.13.10.1
postgresql17-test - update to 17.4-150600.13.10.1
postgresql17-llvmjit-debuginfo - update to 17.4-150600.13.10.1
postgresql17-devel-mini-debuginfo - update to 17.4-150600.13.10.1
postgresql17-mini-debugsource - update to 17.4-150600.13.10.1
postgresql17-devel-mini - update to 17.4-150600.13.10.1
PowerProtect Data Manager - update to 19.19.0-15

• Exploit #11672 - CVE-2025-1094 (June 20, 2025)
• Exploit #11216 - CVE-2025-1094-PoC-Postgre-SQLi (March 18, 2025)
• Exploit #11182 - CVE-2025-1094-Exploit (February 27, 2025)
• Exploit #11135 - BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution (February 17, 2025)

• https://www.postgresql.org/support/security/CVE-2025-1094/
• https://www.postgresql.org/about/news/postgresql-173-167-1511-1416-and-1319-released-3015/
• https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis

• Improper input validation in PostgreSQL
• Red Hat Enterprise Linux 8 update for libpq
• Red Hat Enterprise Linux 8 update for the postgresql:15 module
• Red Hat Enterprise Linux 9 update for the postgresql:15 module
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Red Hat Enterprise Linux 9 update for libpq
• Red Hat Enterprise Linux 9 update for postgresql
• Red Hat Enterprise Linux 9 update for postgresql
• Red Hat Enterprise Linux 9 update for postgresql
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Red Hat Enterprise Linux 9 update for the postgresql:15 module
• Red Hat Enterprise Linux 9 update for the postgresql:16 module
• Red Hat Enterprise Linux 9 update for libpq
• Red Hat Enterprise Linux 9 update for libpq
• Red Hat Enterprise Linux 8 update for libpq
• Red Hat Enterprise Linux 8 update for the postgresql:13 module
• Red Hat Enterprise Linux 8 update for libpq
• Red Hat Enterprise Linux 9 update for libpq
• Red Hat Enterprise Linux 9 update for the postgresql:15 module
• Red Hat Enterprise Linux 9 update for postgresql
• Red Hat Enterprise Linux 9 update for the postgresql:16 module
• Red Hat Enterprise Linux 8 update for the postgresql:15 module
• Red Hat Enterprise Linux 8 update for the postgresql:16 module
• Red Hat Enterprise Linux 8 update for libpq
• Red Hat Enterprise Linux 8 update for libpq
• SUSE update for postgresql13
• SUSE update for postgresql15
• SUSE update for postgresql14
• SUSE update for postgresql17
• SUSE update for postgresql17
• SUSE update for postgresql13
• SUSE update for postgresql14
• SUSE update for postgresql14
• SUSE update for postgresql15
• SUSE update for postgresql15
• SUSE update for postgresql16
• SUSE update for postgresql16
• SUSE update for postgresql16
• SUSE update for postgresql17
• openEuler 24.03 LTS SP1 update for postgresql
• openEuler 22.03 LTS SP3 update for postgresql
• openEuler 22.03 LTS SP4 update for postgresql
• openEuler 24.03 LTS update for postgresql
• openEuler 24.03 LTS SP1 update for libpq
• openEuler 24.03 LTS update for libpq
• openEuler 22.03 LTS SP4 update for libpq
• openEuler 22.03 LTS SP3 update for libpq
• SUSE update for postgresql13
• Ubuntu update for postgresql-12
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.5
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.12
• Multiple vulnerabilities in Red Hat Advanced Cluster Security for Kubernetes 4.6
• Red Hat Enterprise Linux 8 update for the postgresql:12 module
• Anolis OS update for libpq
• Anolis OS update for postgresql:15 module
• Anolis OS update for postgresql:13 module
• Anolis OS update for postgresql:12 module
• openEuler 20.03 LTS SP4 update for postgresql-13
• IBM Sterling Connect:Direct Web Services update for PostgreSQL
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for postgresql
• Tenable Security Center update for PostgreSQL
• Dell APEX Cloud Platform for Red Hat OpenShift update for third-party components
• Multiple vulnerabilities in Dell PowerProtect Data Manager
• Multiple vulnerabilities in IBM Observability with Instana
• Ubuntu update for postgresql-10
• Dell APEX Cloud Platform for Microsoft Azure update for third-party components
• Anolis OS update for postgresql
• Juniper Secure Analytics update for third-party components
• Anolis OS update for libpq
• RSA Authentication Manager update for third-party components
• Multiple vulnerabilities in IBM API Connect
• Anolis OS update for postgresql
• SUSE update for postgresql15
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in Netcool Operations Insight
• Gentoo update for PostgreSQL