{"id":"CVE-2026-105613","kind":"vulnerability","aliases":["CVE-2026-105613"],"related":[],"title":"PostgreSQL Anonymizer: range dummy functions allow unbounded memory use","description":"PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.","summary":"PostgreSQL Anonymizer's range-based dummy data functions do not limit the size of the range they generate. A caller can make a database backend allocate excessive memory, which the operating system may kill, forcing a cluster-wide crash recovery.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","package","postgres-extension","postgresql","self-hosted"],"not_affected_if":["extension-not-installed","patched-3.3.0-or-later"],"how_to_check":"- Check the installed extension version in PostgreSQL with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Check whether the anon extension is loaded at all with `SELECT * FROM pg_available_extensions WHERE name = 'anon';`","fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Re-run `ALTER EXTENSION anon UPDATE;` in each database where the extension is installed","status":"open","published_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","triaged_at":"2026-10-28T18:35:12+00:00","updated_at":"2026-10-28T18:35:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade PostgreSQL Anonymizer to `3.3.0` or later\n- Re-run `ALTER EXTENSION anon UPDATE;` in each database where the extension is installed","reach":"unknown","title":"PostgreSQL Anonymizer: range dummy functions allow unbounded memory use","impact":"medium","summary":"PostgreSQL Anonymizer's range-based dummy data functions do not limit the size of the range they generate. A caller can make a database backend allocate excessive memory, which the operating system may kill, forcing a cluster-wide crash recovery.","category":"package","nicknames":[],"who_cares":["postgresql","postgres-extension","self-hosted","database"],"confidence":0.6,"needs_auth":"unknown","worst_case":"A backend exhausts memory and crashes the whole database cluster","analyst_note":"","how_to_check":"- Check the installed extension version in PostgreSQL with `SELECT extversion FROM pg_extension WHERE extname = 'anon';`\n- Check whether the anon extension is loaded at all with `SELECT * FROM pg_available_extensions WHERE name = 'anon';`","needs_analyst":false,"not_affected_if":["extension-not-installed","patched-3.3.0-or-later"],"who_is_affected":"Teams running PostgreSQL with the PostgreSQL Anonymizer extension installed and its dummy data functions available to users. The sources do not say which roles can call these functions, so treat any role with access as in scope. Systems without the extension can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000619,"input_tokens":3331,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105613':12A,15A '-2026':11A,14A '3.3.0':117C 'alloc':51B 'allow':6A 'anonym':2A,26B,68C,116C 'backend':50B,91C 'base':30B,72C 'caller':45B 'cluster':63B,106C 'cluster-wid':62B,105C 'constraint':76C 'crash':65B,108C 'cve':10A,13A 'data':32B 'databas':16B,49B 'dont':75C 'dummi':4A,31B,73C 'excess':52B 'exhaust':86C 'exploit':84C 'extens':20B 'forc':60B 'function':5A,33B,74C 'generat':43B 'host':24B 'kill':59B,95C 'later':119C 'limit':36B 'make':47B 'may':58B 'memori':8A,53B,88C 'oom':94C 'oom-kil':93C 'oper':56B 'ovecommit':98C 'packag':17B 'postgr':19B 'postgres-extens':18B 'postgresql':1A,21B,25B,67C,115C 'problem':111C 'rang':3A,29B,41B,71C,78C 'range-bas':28B,70C 'recoveri':66B,109C 'resolv':113C 'result':102C 'self':23B 'self-host':22B 'size':38B,79C 'system':57B 'unbound':7A 'use':9A 'version':120C 'vulner':81C 'wide':64B,107C","nicknames":[],"mitigations":[],"who_affected":"Teams running PostgreSQL with the PostgreSQL Anonymizer extension installed and its dummy data functions available to users. The sources do not say which roles can call these functions, so treat any role with access as in scope. Systems without the extension can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105613","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105613","severity":null,"published_at":"2026-10-28T18:17:03+00:00","modified_at":"2026-10-28T18:17:03+00:00","first_seen_at":"2026-10-28T18:34:32+00:00","fetched_at":"2026-10-28T18:34:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}