Memory Exhaustion Vulnerability in PostgreSQL Anonymizer by Dalibo
CVE-2026-105614

4.7MEDIUM

Key Information:

Vendor

Dalibo

Status
Postgresql Anonymizer
Vendor
CVE Published:
28 October 2026

What is CVE-2026-105614?

The PostgreSQL Anonymizer's anon.image_blur() function lacks validation of the declared dimensions of input images. This oversight allows attackers to submit a small image while declaring enormous dimensions, leading to potential memory exhaustion and backend crashes. In environments with overcommit enabled, this could result in an Out Of Memory (OOM) condition, triggering cluster-wide recovery processes. The issue has been addressed in PostgreSQL Anonymizer version 3.3.0 and later.

Affected Version(s)

PostgreSQL Anonymizer 1 < 3.3.0

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/691

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The PostgreSQL Anonymizer project thanks user Alexander Kukushkin for reporting this problem.
.