{"id":"CVE-2026-120058","kind":"vulnerability","aliases":["CVE-2026-120058"],"related":[],"title":"psqlODBC: a malicious server can overflow driver memory via FETCH replies","description":"psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.","summary":"psqlODBC sizes its row cache from the first result's column count but trusts later FETCH replies without checking them. A server the client does not trust can send a later reply with more columns and make the driver write past a heap allocation, or underflow a field count on keyset replies.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["c-sharp","odbc","package","postgresql","psqlodbc","python"],"not_affected_if":["default-config","no-declare-fetch","trusted-server-only"],"how_to_check":"- Find the installed psqlODBC driver version and check whether it is below `18.00.0006`.\n- Check whether `UseDeclareFetch` is enabled in the DSN or connection string.\n- Check whether the connection can reach a database server that is not trusted under current SSL settings.","fix":"- psqlODBC versions before `18.00.0006` are affected; move to `18.00.0006` or later.","status":"open","published_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:41+00:00","updated_at":"2026-11-02T19:26:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T19:26:41Z","model":"claude-haiku-5-5","output":{"fix":"- psqlODBC versions before `18.00.0006` are affected; move to `18.00.0006` or later.","reach":"network","title":"psqlODBC: a malicious server can overflow driver memory via FETCH replies","impact":"high","summary":"psqlODBC sizes its row cache from the first result's column count but trusts later FETCH replies without checking them. A server the client does not trust can send a later reply with more columns and make the driver write past a heap allocation, or underflow a field count on keyset replies.","audience":"developers","category":"package","nicknames":[],"who_cares":["psqlodbc","postgresql","odbc","python","c-sharp"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"a malicious server can corrupt driver heap memory and possibly run code","analyst_note":"Check the vendor advisory on github.com for the exact affected versions, the conditions under which the SSL trust check fails, and whether code execution is demonstrated.","how_to_check":"- Find the installed psqlODBC driver version and check whether it is below `18.00.0006`.\n- Check whether `UseDeclareFetch` is enabled in the DSN or connection string.\n- Check whether the connection can reach a database server that is not trusted under current SSL settings.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-server-only","default-config","no-declare-fetch"],"who_is_affected":"Applications that use the psqlODBC driver to connect to PostgreSQL, especially with UseDeclareFetch enabled and a server that is not fully trusted under current SSL settings. Systems that connect only to trusted, verified PostgreSQL servers with default settings are less exposed. The sources do not say whether default settings enable UseDeclareFetch.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000746,"input_tokens":4206,"output_tokens":651,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120058':14A,17A '-2026':13A,16A '18.00.0006':163C 'affect':165C 'alloc':69B,137C 'also':148C 'answer':117C 'c':19B 'c-sharp':18B 'cach':30B,82C 'check':44B,104C 'client':49B 'column':36B,60B,85C,96C,123C,143C 'count':37B,74B,86C,97C,153C 'current':113C 'cursor':89C 'cve':12A,15A 'driver':7A,64B,127C 'enabl':159C 'end':133C 'fetch':10A,41B,101C,120C 'fewer':142C 'field':73B,147C,152C 'first':33B,91C 'heap':68B,136C 'key':146C 'keyset':76B,139C 'later':40B,56B,100C,119C 'make':62B,125C 'malici':3A 'match':107C 'memori':8A 'odbc':21B 'overflow':6A 'packag':22B 'past':66B,131C 'postgresql':23B 'psqlodbc':1A,24B,26B,78C,162C 'python':25B 'reachabl':156C 'recomput':94C 'record':130C 'repli':11A,42B,57B,77B,102C,140C 'result':34B,92C 'row':29B,81C 'send':54B 'server':4A,47B,109C 'set':115C 'sharp':20B 'size':27B,79C 'ssl':114C 'trust':39B,52B,111C 'tupl':129C 'underflow':71B,149C 'unsign':151C 'usedeclarefetch':158C 'version':160C 'via':9A 'without':43B,103C 'write':65B,128C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the psqlODBC driver to connect to PostgreSQL, especially with UseDeclareFetch enabled and a server that is not fully trusted under current SSL settings. Systems that connect only to trusted, verified PostgreSQL servers with default settings are less exposed. The sources do not say whether default settings enable UseDeclareFetch.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["csharp","high","odbc","package","postgresql","psqlodbc","python"],"first_public_at":"2026-11-02T19:18:02+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120058","severity":null,"published_at":"2026-11-02T19:18:02+00:00","modified_at":"2026-11-02T19:18:02+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53469,"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-6rmx-9q62-4w6m","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}