Skip to content
OpenAdvisories
High USN-7315-1 1 CVE

postgresql-12, postgresql-14, postgresql-16 vulnerability

Published Mar 3, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

Stephen Fewer discovered that PostgreSQL incorrectly handled quoting syntax
in certain scenarios. A remote attacker could possibly use this issue to
perform SQL injection attacks.

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS postgresql-12 12.22-0ubuntu0.20.04.2
Ubuntu · 22.04 LTS 22.04:LTS postgresql-14 14.17-0ubuntu0.22.04.1
Ubuntu · 24.04 LTS 24.04:LTS postgresql-16 16.8-0ubuntu0.24.04.1

Vulnerabilities 1

  • High 8.1
    CVE-2025-1094 Public exploit EPSS 90%

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …

    postgresql-15 postgresql-9.3 postgresql-17 postgresql15 Debian Ubuntu Azure Linux Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2025-1094