PostGIS Address Standardizer Vulnerability Allowing Out-of-Bounds Reads

CVE-2026-90775

What is CVE-2026-90775?

The PostGIS Address Standardizer versions prior to 3.7.1 are vulnerable to an out-of-bounds read issue stemming from the Weight parameter in user-defined rules. Attackers can exploit this vulnerability by providing malicious input that contains out-of-range Weight values. This input is improperly validated, leading to an attempt to access the load_value array at invalid indices. The consequence of this flaw is a crash of the PostgreSQL backend process, which disrupts operations and terminates all active cluster sessions, leaving the system in a potentially compromised state.

References