[ CVE-2026-105613 · Published 28 Oct 2026 ]
Vulnerability in DALIBO PostgreSQL Anonymizer
CVSS 4.7
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1413
Multiple vulnerabilities in PostgreSQL Anonymizer Translated from French
Multiple vulnerabilities have been discovered in PostgreSQL Anonymizer. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a security policy bypass.