CVE-2025-12817
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to cause denial of service against other CREATE STATISTICS users by creating an object in any schema. A later CREATE STATISTICS for the same name by a user with CREATE privilege would fail. Affects versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23.
Risk Assessment
This may prevent other users from creating statistics, disrupting application or analytical processes.
Recommendation
Update PostgreSQL to version 18.1, 17.7, 16.11, 15.15, 14.20, or 13.23 (or later).
Other vulnerabilities in PostgreSQL
See all- CVE-2017-15098High
Invalid json_populate_recordset or jsonb_populate_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, and 9.3.x before 9.3.20 can crash the server or disclose a few bytes of server memory.
- CVE-2017-7548High
PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.
- CVE-2017-7547High
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers to retrieve passwords from user mappings defined by foreign server owners without actually having the privileges to do so.
- CVE-2017-7484High
Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.
- CVE-2016-5424High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 may allow remote authenticated users with the CREATEDB or CREATEROLE role to gain superuser privileges through mishandling of special characters in database or role names.
- CVE-2016-5423High
PostgreSQL versions before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a denial of service (NULL pointer dereference and server crash), obtain sensitive memory information, or possibly execute arbitrary code via (1) a CASE expression within the test value subexpression of another CASE or (2) inlining of an SQL function that implements the equality operator used for a CASE expression involving values of different types.
- CVE-2016-2193High
PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions.
- CVE-2016-0773High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 are vulnerable to remote attacks that can lead to denial of service via an infinite loop or buffer overflow.
- CVE-2016-0766High
PostgreSQL versions before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 do not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, allowing attackers to gain privileges via unspecified vectors.
- CVE-2024-10976Medium
Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.
Original NVD description (English source)
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS