Description
PostgreSQL 8.1.x before 8.1.4, 8.0.x before 8.0.8, 7.4.x before 7.4.13, 7.3.x before 7.3.15, and earlier versions allows context-dependent attackers to bypass SQL injection protection methods in applications that use multibyte encodings that allow the "\" (backslash) byte 0x5c to be the trailing byte of a multibyte character, such as SJIS, BIG5, GBK, GB18030, and UHC, which cannot be handled correctly by a client that does not understand multibyte encodings, aka a second variant of "Encoding-Based SQL Injection." NOTE: it could be argued that this is a class of issue related to interaction errors between the client and PostgreSQL, but a CVE has been assigned since PostgreSQL is treating this as a preventative measure against this class of problem.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pygresql | 3.8-1.1 | — |
| Debian 13 | pygresql | 3.8-1.1 | — |
| Debian 12 | pygresql | 3.8-1.1 | — |
| Debian 3.1 | postgresql | 7.4.7-6sarge2 | DSA-1087-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | postgresql +10 | 7.4.13-2.RHEL4.1 | RHSA-2006:0526 |
| RHEL 3 | rh-postgresql +10 | 7.3.15-2 | RHSA-2006:0526 |
Advisories 2
- RHSA-2006:0526 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-1087-1 postgresql - programming error Debian Security (DSA / DLA) · Mar 9, 2026
References
- postgresql-ascii-sql-injection(26628) vdb-entry
- GLSA-200607-04 vendor-advisory
- 20435 third-party-advisory
- 18092 vdb-entry
- 20503 third-party-advisory
- 20451 third-party-advisory
- 21001 third-party-advisory
- http://www.postgresql.org/docs/techdocs.50
- 20231 third-party-advisory
- 20653 third-party-advisory
- SUSE-SA:2006:030 vendor-advisory
- 21749 third-party-advisory
- 25731 vdb-entry
- 20782 third-party-advisory
- RHSA-2006:0526 vendor-advisory
- 2006-0032 vendor-advisory
- ADV-2006-1941 vdb-entry
- 20060524 rPSA-2006-0080-1 postgresql postgresql-server mailing-list
- 20232 third-party-advisory
- 20060523 PostgreSQL security releases 8.1.4, 8.0.8, 7.4.13, 7.3.15 mailing-list
- USN-288-1 vendor-advisory
- MDKSA-2006:098 vendor-advisory
- SUSE-SR:2006:021 vendor-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-113.htm
- postgresql-multibyte-sql-injection(26627) vdb-entry
- oval:org.mitre.oval:def:9947 vdb-entry signature
- 20555 third-party-advisory
- [pgsql-announce] 20060523 Security Releases for All Active Versions mailing-list
- 1016142 vdb-entry
- USN-288-3 vendor-advisory
- USN-288-2 vendor-advisory
- 20314 third-party-advisory
- DSA-1087 vendor-advisory