CVE-2025-12817

LOW

PostgreSQL <18.1, 17.7, 16.11, 15.15, 14.20, 13.23 - DoS

Title source: llm
STIX 2.1

Description

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

References (1)

Core 1

Scores

CVSS v3 3.1
EPSS 0.0020
EPSS Percentile 9.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (6)
n/a/PostgreSQL < 13.23
n/a/PostgreSQL 14 - 14.20
n/a/PostgreSQL 15 - 15.15
n/a/PostgreSQL 16 - 16.11
n/a/PostgreSQL 17 - 17.7
n/a/PostgreSQL 18 - 18.1
Published Nov 13, 2025
Tracked Since Feb 18, 2026