{"id":"CVE-2026-120060","kind":"vulnerability","aliases":["CVE-2026-120060"],"related":[],"title":"psqlODBC: server data can crash the client or read out of bounds","description":"psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.","summary":"psqlODBC is the PostgreSQL ODBC driver. Three code paths trust row counts, key counts and escape lengths sent by the server, so a malicious or untrusted server can crash the client or cause out-of-bounds reads.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","odbc","package","postgresql","psqlodbc","windows"],"not_affected_if":["fully-trusted-servers","no-psqlodbc"],"how_to_check":"- Check the installed psqlODBC driver version and compare it with `18.00.0006`.\n- Find where the driver is installed on the machine or in the container image.\n- Note whether connections go to servers that are not fully trusted under the current SSL settings.","fix":"- psqlODBC versions before `18.00.0006` are affected; move to `18.00.0006` or later.","status":"open","published_at":"2026-11-02T19:18:03+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:50+00:00","updated_at":"2026-11-02T19:26:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-02T19:26:50Z","model":"claude-haiku-5-5","output":{"fix":"- psqlODBC versions before `18.00.0006` are affected; move to `18.00.0006` or later.","reach":"network","title":"psqlODBC: server data can crash the client or read out of bounds","impact":"medium","summary":"psqlODBC is the PostgreSQL ODBC driver. Three code paths trust row counts, key counts and escape lengths sent by the server, so a malicious or untrusted server can crash the client or cause out-of-bounds reads.","audience":"businesses","category":"package","nicknames":[],"who_cares":["postgresql","odbc","psqlodbc","windows","linux"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"client crashes or reads memory out of bounds","analyst_note":"","how_to_check":"- Check the installed psqlODBC driver version and compare it with `18.00.0006`.\n- Find where the driver is installed on the machine or in the container image.\n- Note whether connections go to servers that are not fully trusted under the current SSL settings.","plain_action":"","needs_analyst":false,"not_affected_if":["fully-trusted-servers","no-psqlodbc"],"who_is_affected":"Systems that use the psqlODBC driver to connect to PostgreSQL servers, especially where the server is not fully trusted under the current SSL settings. A server the team controls and fully trusts is a lower risk. Teams that do not use psqlODBC can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4194,"output_tokens":536,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120060':15A,18A '-2026':14A,17A '18.00.0006':145C 'affect':147C 'bound':12A,61B,101C,141C 'byte':114C 'bytea':107C 'caus':57B 'client':7A,55B,134C 'code':32B 'count':36B,38B,65C,81C,99C 'crash':5A,53B,132C 'current':128C 'cve':13A,16A 'data':3A,70C 'decod':109C 'driver':30B 'end':117C 'escap':40B,121C 'fix':105C 'index':91C 'iter':90C 'key':37B,92C,98C 'length':41B,67C 'linux':19B 'make':136C 'malici':48B 'octal':108C 'odbc':20B,29B 'out-of-bound':58B 'packag':21B 'past':115C 'path':33B 'place':73C 'postgresql':22B,28B 'psqlodbc':1A,23B,25B,63C,144C 'read':9A,62B,110C,138C 'row':35B,80C 'sent':42B 'sequenc':122C 'server':2A,45B,51B,69C,78C,96C,124C 'server-suppli':77C,95C 'set':130C 'size':84C 'sqlbulkoper':74C 'sqlstatist':89C 'ssl':129C 'storag':106C 'subtract':85C 'suppli':79C,97C 'three':31B,72C 'truncat':120C 'trust':34B,64C,126C 'two':113C 'underflow':88C 'untrust':50B 'use':75C,93C 'version':142C 'window':24B 'without':100C","nicknames":[],"mitigations":[],"who_affected":"Systems that use the psqlODBC driver to connect to PostgreSQL servers, especially where the server is not fully trusted under the current SSL settings. A server the team controls and fully trusts is a lower risk. Teams that do not use psqlODBC can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["linux","medium","odbc","package","postgresql","psqlodbc","windows"],"first_public_at":"2026-11-02T19:18:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120060","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120060","severity":null,"published_at":"2026-11-02T19:18:03+00:00","modified_at":"2026-11-02T19:18:03+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[{"id":53471,"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-4mfx-cfxx-c877","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}