---
id: "CVE-2026-110182"
kind: "vulnerability"
aliases: ["CVE-2026-110182"]
title: "PostgreSQL Anonymizer: partial() masking can reveal whole short values"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "postgresql", "postgresql-anonymizer", "self-hosted"]
not_affected_if: ["long-values-only", "not-using-partial-functions"]
published_at: "2026-10-28T18:17:05+00:00"
first_seen_at: "2026-10-28T18:34:32+00:00"
updated_at: "2026-10-28T18:35:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110182", "first_seen_at": "2026-10-28T18:34:32+00:00"}]
---

# PostgreSQL Anonymizer: partial() masking can reveal whole short values

The anon.partial() and anon.partial_email() functions in PostgreSQL Anonymizer can expose the full original value when that value is short. An attacker who can read the masked output recovers data the masking was meant to hide.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed extension version with `SELECT extversion FROM pg_extension WHERE extname = 'anon';` and compare it to `3.3.0`
- Search application code and queries for calls to `anon.partial(` and `anon.partial_email(` on short fields

## Fix

- Upgrade PostgreSQL Anonymizer to `3.3.0` or later
- Until upgraded, avoid anon.partial() and anon.partial_email() on short values and use a different masking function

## Timeline

- 2026-10-28T18:34:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110182

## From the sources

PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_