Read the docs
TI-2025-11740 Aliases CVE-2025-12817GHSA-99qj-9hw7-85x8

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Priority LOW 15CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 21 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-862.

Summary

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00243 15th percentileScored 2026-11-07
Fix Partial PostgreSQL: 18.1, 17.7, 16.11 +3Red Hat: 22 advisoriesRed Hat: 21 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
—PostgreSQL18 to before 18.1; 17 to before 17.7; 16 to before 16.11; 15 to before 15.15; 14 to before 14.20; before 13.2318.1, 17.7, 16.11, 15.15, 14.20, 13.23Patch availableCNA
  • PostgreSQL Vendor— Affected 18 to before 18.1; 17 to before 17.7; 16 to before 16.11; 15 to before 15.15; 14 to before 14.20; before 13.23 Fixed in 18.1, 17.7, 16.11, 15.15, 14.20, 13.23 Patch available CNA

Remediation

  • Fix · CNA PostgreSQL Fixed in 18.1, 17.7, 16.11, 15.15, 14.20, 13.23

Red Hat 22 advisories

  • RHSA-2026:8756 Released 2026-04-17 · Red Hat rating Important
    Red Hat Hardened Images RPMs bug fix and enhancement update
    • Red Hat Hardened Images postgresql18-18.3-1.2.hum1@src
  • RHSA-2026:0524 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.9.0+19797+c4ce5969.s390x::postgresql:15 +47
  • RHSA-2026:0523 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.9.0+20664+9c30cf7f.s390x::postgresql:13 +47
Show 19 more Red Hat advisories
  • RHSA-2026:0525 Released 2026-01-13 · Red Hat rating Moderate
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream (v. 10) postgresql-16.11-1.el10_1, postgresql-contrib-16.11-1.el10_1, postgresql-docs-16.11-1.el10_1 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) postgresql-test-rpm-macros-16.11-1.el10_1
  • RHSA-2026:0519 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 8) pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el8.10.0+22551+c0330dc9.s390x::postgresql:16 +47
  • RHSA-2026:0493 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:0492 Released 2026-01-13 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream (v. 9) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2026:0491 Released 2026-01-13 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream (v. 9) postgresql-13.23-1.el9_7, postgresql-contrib-13.23-1.el9_7, postgresql-plperl-13.23-1.el9_7 +5
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) postgresql-docs-13.23-1.el9_7, postgresql-private-devel-13.23-1.el9_7, postgresql-server-devel-13.23-1.el9_7 +4
  • RHSA-2026:0455 Released 2026-01-12 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) postgresql-13.23-1.el9_2, postgresql-contrib-13.23-1.el9_2, postgresql-plperl-13.23-1.el9_2 +5
  • RHSA-2026:0456 Released 2026-01-12 · Red Hat rating Moderate
    postgresql16 security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) postgresql-16.11-1.el10_0, postgresql-contrib-16.11-1.el10_0, postgresql-docs-16.11-1.el10_0 +12
    • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) postgresql-test-rpm-macros-16.11-1.el10_0
  • RHSA-2026:0268 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.6) postgresql-docs-13.23-1.el9_6, postgresql-private-devel-13.23-1.el9_6, postgresql-server-devel-13.23-1.el9_6 +4
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) postgresql-13.23-1.el9_6, postgresql-contrib-13.23-1.el9_6, postgresql-plperl-13.23-1.el9_6 +5
  • RHSA-2026:0269 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.aarch64::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.ppc64le::postgresql:16, pg_repack-1.5.1-1.module+el9.6.0+22880+6b241eec.s390x::postgresql:16 +47
  • RHSA-2026:0264 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:16 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.aarch64::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.ppc64le::postgresql:16, pg_repack-1.4.8-1.module+el9.4.0+20427+07482b8c.s390x::postgresql:16 +47
  • RHSA-2026:0262 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat CodeReady Linux Builder EUS (v.9.4) postgresql-docs-13.23-1.el9_4, postgresql-private-devel-13.23-1.el9_4, postgresql-server-devel-13.23-1.el9_4 +3
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) postgresql-13.23-1.el9_4, postgresql-contrib-13.23-1.el9_4, postgresql-plperl-13.23-1.el9_4 +5
  • RHSA-2026:0270 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13 +32
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:0267 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.aarch64::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.ppc64le::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.s390x::postgresql:13 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.src::postgresql:13, pg_repack-1.4.6-3.module+el8.5.0+11357+bcc62552.x86_64::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13 +17
  • RHSA-2026:0266 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15 +36
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15, pg_repack-1.4.8-1.module+el8.8.0+17071+aaaceaa4.x86_64::postgresql:15, pgaudit-1.7.0-1.module+el8.8.0+17071+aaaceaa4.src::postgresql:15 +19
  • RHSA-2026:0265 Released 2026-01-08 · Red Hat rating Moderate
    postgresql:13 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.src::postgresql:13, pgaudit-1.5.0-1.module+el8.4.0+8873+b821c30a.x86_64::postgresql:13, postgres-decoderbufs-0.10.0-2.module+el8.4.0+8873+b821c30a.src::postgresql:13 +15
  • RHSA-2026:0263 Released 2026-01-08 · Red Hat rating Moderate
    postgresql security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) postgresql-13.23-1.el9_0, postgresql-contrib-13.23-1.el9_0, postgresql-plperl-13.23-1.el9_0 +5
  • RHSA-2025:23023 Released 2025-12-10 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.aarch64::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.ppc64le::postgresql:15, pg_repack-1.4.8-2.module+el9.5.0+22224+f5585c78.s390x::postgresql:15 +47
  • RHSA-2025:23022 Released 2025-12-10 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47
  • RHSA-2025:22728 Released 2025-12-04 · Red Hat rating Moderate
    postgresql:15 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.aarch64::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.ppc64le::postgresql:15, pg_repack-1.4.8-1.module+el9.2.0+17405+aeb9ec60.s390x::postgresql:15 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    PostgreSQL 13.23, 14.20 and 4 more versions

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2025-11741 PostgreSQL libpq undersizes allocations, via integer wraparoundPriority LOW 26
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Out of support scope
Red Hat CodeReady Linux Builder EUS (v.9.4)Fixed RHSA-2026:0262
Red Hat CodeReady Linux Builder EUS (v.9.6)Fixed RHSA-2026:0268
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:0525
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:0519, RHSA-2026:0523, RHSA-2026:0524
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:0491, RHSA-2026:0492, RHSA-2026:0493
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:0265
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:0267
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:0267
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:0266, RHSA-2026:0270
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:0263
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:23022, RHSA-2026:0455
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:0456
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:22728, RHSA-2026:0262, RHSA-2026:0264
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:23023, RHSA-2026:0268, RHSA-2026:0269
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:0265
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:0267
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:0266, RHSA-2026:0270
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:0525
Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)Fixed RHSA-2026:0491
Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)Fixed RHSA-2026:0456
Red Hat Hardened ImagesFixed RHSA-2026:8756
Not affected: 1 product
  • Red Hat Hardened Images

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-12817
  2. 2026-10-03 Alias added: GHSA-99qj-9hw7-85x8

References

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences