Vulnerability in DALIBO PostgreSQL Anonymizer

[ Description ]Official description

PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR29 Oct 2026CERTFR-2026-AVI-1413

  Multiple vulnerabilities in PostgreSQL Anonymizer Translated from French

  Multiple vulnerabilities have been discovered in PostgreSQL Anonymizer. Some of them allow an attacker to cause remote denial of service, a breach of data confidentiality and a security policy bypass.

  CVE-2026-110183CVE-2026-105613CVE-2026-110182+9 more CVEs

[ References ]References

• gitlab.com/dalibo/postgresql_anonymizer/-/issues/691