Loading story…
Researchers disclosed an integer wraparound/overflow flaw in PostgreSQL’s libpq client library (tracked as CVE-2025-12818) that can be triggered via the PQescapeInternal code path used by PQescapeLiteral and PQescapeIdentifier. When a crafted input string of certain lengths includes quotes and/or backslashes, libpq can miscalculate the required buffer size, allocate too little memory, and then perform an out-of-bounds write by hundreds of megabytes, typically resulting in a segmentation fault (DoS) in the consuming application.
F5’s product advisories state that PostgreSQL versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected by CVE-2025-12818, but report no impact to F5 products after evaluation. Separate F5 advisories published alongside this disclosure cover unrelated issues, including a PostgreSQL authorization/DoS issue in CREATE STATISTICS (CVE-2025-12817), a curl cross-protocol redirect token-leak issue (CVE-2025-14524), an Apache Solr create core input-validation/allowPaths bypass with potential NTLM hash disclosure on Windows (CVE-2026-22444), and a local privilege-escalation issue in the Intel 800 Series Ethernet Linux driver affecting certain F5 appliance lines (CVE-2025-24325).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Positive Technologies published a detailed write-up showing how the libpq integer overflow can be triggered with extremely long escaped input and demonstrated escalation to an application-layer crash through PHP's pdo_pgsql driver.
F5 published a product advisory referencing PostgreSQL vulnerability CVE-2025-12818, indicating downstream vendor awareness and guidance related to the issue.
PostgreSQL released a security advisory for CVE-2025-12818, describing a denial-of-service issue in the libpq client library and listing patched versions across supported branches.
PostgreSQL published a fix in the postgres/postgres repository for an integer overflow in libpq's PQescapeInternal function that can lead to an undersized allocation and out-of-bounds write, tracked as CVE-2025-12818.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
F5 issued a security update for **BIG-IP Next for Kubernetes** to remediate multiple PostgreSQL vulnerabilities that could let an attacker execute arbitrary code as the operating system user running the database. The update highlights **`CVE-2026-2006`**, a PostgreSQL flaw involving missing validation of multibyte character length, rated **CVSS 8.8**, and also references **`CVE-2026-2005`** and **`CVE-2026-2004`**. The advisories urge organizations using the affected platform to test and deploy the patch quickly and to coordinate with vendors whose products embed the vulnerable third-party component to determine exposure. The notices were published through EG-FinCIRT and describe the issue as affecting the PostgreSQL component within F5's Kubernetes-focused application delivery platform.
Jul 9, 2026Microsoft published security advisories for two database-related vulnerabilities affecting **PostgreSQL** and **PgBouncer**, both tied to integer handling errors that can destabilize services. **CVE-2026-6473** describes a PostgreSQL server flaw in which allocations can be undersized because of integer wraparound, while **CVE-2026-6664** affects PgBouncer network packet parsing and is classified as an integer overflow issue under **CWE-190**. The PgBouncer flaw carries a **CVSS v3.1 score of 7.5** with vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`, indicating a remotely exploitable issue that requires no privileges or user interaction and can cause a high availability impact, including denial of service. Microsoft released the PgBouncer notice on May 10 and later updated it, while the PostgreSQL advisory was published on May 16, signaling active vendor attention to memory-allocation and packet-parsing weaknesses in widely used database infrastructure components.
Jun 29, 2026
PostgreSQL released security updates for supported branches to fix multiple high-severity vulnerabilities affecting versions before **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**. The most serious issues include **CVE-2026-6473**, an integer wraparound bug that can cause undersized allocations and out-of-bounds writes, and **CVE-2026-6637**, a flaw in the `refint` module that can lead to a stack buffer overflow. In both cases, an unprivileged database user may be able to achieve arbitrary code execution as the operating system account running PostgreSQL. The `refint` issue also exposes a separate SQL injection path when applications use a user-controlled column as a `refint` cascade primary key and allow user-controlled updates, potentially enabling arbitrary SQL execution as the database user performing the update. Debian issued security advisories for **postgresql-15** and **postgresql-17**, and the Canadian Centre for Cyber Security urged administrators to review PostgreSQL’s advisory and deploy the patched releases **14.23**, **15.18**, **16.14**, **17.10**, and **18.4**.
Jun 29, 2026