Memory Exhaustion Vulnerability in PostgreSQL Anonymizer by Dalibo
CVE-2026-105613

4.7MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105613?

A vulnerability in PostgreSQL Anonymizer allows attackers to exploit range-based dummy functions that do not limit range size. This oversight can lead to excessive memory consumption in a backend process, potentially resulting in an out-of-memory condition under certain configurations. Consequently, this can trigger a cluster-wide crash recovery, impacting database availability and performance. Users are encouraged to upgrade to PostgreSQL Anonymizer version 3.3.0 or later to mitigate this issue.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/690

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Alexander Kukushkin for reporting this problem.
.