Skip to content
OpenAdvisories
Critical USN-9047-1 1 CVE

asyncpg vulnerability

Published Nov 11, 2026 · Updated Nov 12, 2026

Ecosystem: Ubuntu

Summary

It was discovered that asyncpg incorrectly handled certain array data
returned by a PostgreSQL server. A remote attacker controlling a PostgreSQL
server could possibly use this issue to cause asyncpg to crash, resulting
in a denial of service, or execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS asyncpg 0.13.0-1ubuntu3+esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS asyncpg 0.20.0-1ubuntu0.1~esm1

Vulnerabilities 1

  • Critical 9.8
    CVE-2020-17446

    Asyncpg Arbitrary Code Execution Via Access to an Uninitialized Pointer

    asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, because of access to an uninitialized pointer in the array data decoder.

    asyncpg asyncpg asyncpg Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2020-17446