psqlODBC memory corruption and SQL injection flaws
Programs using this PostgreSQL connection driver can be hacked.
Summary
psqlODBC is a driver for connecting to PostgreSQL. Untrusted servers or man-in-the-middle attackers can overwrite client memory or change the SQL that runs, through several flaws. Versions before 18.00.0006 are affected.
Affected when
- Connecting to a server not trusted under current SSL settings
- Fetching large-object (lo) columns
- Updatable cursors in use (default setting)
What to do
Update to psqlODBC 18.00.0006 or later. Until then, do not fetch large-object columns from servers that are not trusted.
Products and platforms
CVE IDs
- CVE-2026-120057 (opens in a new tab)
- CVE-2026-120058 (opens in a new tab)
- CVE-2026-120059 (opens in a new tab)
- CVE-2026-120060 (opens in a new tab)
- CVE-2026-120061 (opens in a new tab)
- CVE-2026-120062 (opens in a new tab)
- CVE-2026-120063 (opens in a new tab)
- CVE-2026-120064 (opens in a new tab)
- CVE-2026-120065 (opens in a new tab)
- CVE-2026-120066 (opens in a new tab)
- CVE-2026-120067 (opens in a new tab)
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab) · github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen