SQL Injection Vulnerability in Postgrex Affected by Elixir Ecto

CVE-2026-58225

What is CVE-2026-58225?

An SQL Injection vulnerability exists in Postgrex through Elixir's Ecto, allowing attackers to manipulate LISTEN channel names. This exploitation can lead to a denial of service, as malformed channel names cause the notification connection to break. While it does not permit arbitrary SQL execution, the flaw disrupts the notification system's ability to maintain subscriptions, resulting in silent data loss. Applications utilizing untrusted input for channel names are particularly vulnerable, impacting shared notification connections across multiple tenants.

References