Read the docs
TI-2025-07974 Aliases CVE-2025-8713GHSA-cqj3-wjpm-fjvp

PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

Priority LOW 15CWE-1230Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 12 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.

Summary

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Fix Partial PostgreSQL: 17.6, 16.10, 15.14 +2Red Hat: 13 advisoriesRed Hat: 12 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL17 to before 17.6; 16 to before 16.10; 15 to before 15.14; 14 to before 14.19; before 13.2217.6, 16.10, 15.14, 14.19, 13.22Patch availableCNA
  • PostgreSQL Vendor— Affected 17 to before 17.6; 16 to before 16.10; 15 to before 15.14; 14 to before 14.19; before 13.22 Fixed in 17.6, 16.10, 15.14, 14.19, 13.22 Patch available CNA

Remediation

  • Fix · CNA PostgreSQL Fixed in 17.6, 16.10, 15.14, 14.19, 13.22

Red Hat 13 advisories

  • RHSA-2025:15359 Released 2025-09-04 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2025:15114 Released 2025-09-03 · Red Hat rating Important
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) postgresql-docs-13.22-1.el9_4, postgresql-private-devel-13.22-1.el9_4, postgresql-server-devel-13.22-1.el9_4 +3
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) postgresql-13.22-1.el9_4, postgresql-contrib-13.22-1.el9_4, postgresql-plperl-13.22-1.el9_4 +5
  • RHSA-2025:15062 Released 2025-09-02 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
Show 10 more Red Hat advisories
  • RHSA-2025:15057 Released 2025-09-02 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2025:15031 Released 2025-09-02 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2025:15014 Released 2025-09-02 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2025:15015 Released 2025-09-02 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2025:15013 Released 2025-09-02 · Red Hat rating Important
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2025:14878 Released 2025-08-28 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.22-1.el9_6, postgresql-contrib-13.22-1.el9_6, postgresql-plperl-13.22-1.el9_6 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.22-1.el9_6, postgresql-private-devel-13.22-1.el9_6, postgresql-server-devel-13.22-1.el9_6 +4
  • RHSA-2025:14870 Released 2025-08-28 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) postgresql-13.22-1.el9_0, postgresql-contrib-13.22-1.el9_0, postgresql-plperl-13.22-1.el9_0 +5
  • RHSA-2025:14869 Released 2025-08-28 · Red Hat rating Important
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.22-1.el9_2, postgresql-contrib-13.22-1.el9_2, postgresql-plperl-13.22-1.el9_2 +5
  • RHSA-2025:14862 Released 2025-08-28 · Red Hat rating Important
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2025:14827 Released 2025-08-28 · Red Hat rating Important
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 13.22, 14.19 and 3 more versions

    3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-07976 PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target serverPriority MEDIUM 41
    • TI-2025-07975 PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql clientPriority MEDIUM 41
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2025:15114
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:14827, RHSA-2025:14862, RHSA-2025:14878
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:15057
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:15359
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:15359
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:15013, RHSA-2025:15031
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:14870
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:14869, RHSA-2025:15062
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:15014, RHSA-2025:15015, RHSA-2025:15114
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:15359
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:15013, RHSA-2025:15031
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2025:14878

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-8713
  2. 2026-10-03 Alias added: GHSA-cqj3-wjpm-fjvp

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences