Live › vulnerability › CVE-2026-105614
Go to dashboardThe anon.image_blur() function in PostgreSQL Anonymizer does not check the declared dimensions of an input image, so a small file claiming huge dimensions can be supplied. Processing it can exhaust backend memory, causing the out-of-memory killer to terminate the backend and trigger a cluster-wide crash recovery.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Only deployments that have the PostgreSQL Anonymizer extension installed and call anon.image_blur() on image data, typically during data masking or anonymization jobs. Systems that do not install the extension, or that run versions 3.3.0 and later, are not affected. Exposure is mainly a concern where untrusted users can supply images that reach that function.
No product ranges from the sources yet.
SELECT extversion FROM pg_extension WHERE extname = 'anon'; in each database where the extension is installed and compare against 3.3.0.anon.image_blur function is used by application code or any SQL you run.3.3.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
PostgreSQL Anonymizer's anon.image_blur() function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-105614")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.