Live › vulnerability › CVE-2026-105613
Go to dashboardPostgreSQL Anonymizer's range-based dummy data functions do not limit the size of the range they generate. A caller can make a database backend allocate excessive memory, which the operating system may kill, forcing a cluster-wide crash recovery.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Teams running PostgreSQL with the PostgreSQL Anonymizer extension installed and its dummy data functions available to users. The sources do not say which roles can call these functions, so treat any role with access as in scope. Systems without the extension can skip it.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon';SELECT * FROM pg_available_extensions WHERE name = 'anon';3.3.0 or laterALTER EXTENSION anon UPDATE; in each database where the extension is installedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105613")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.