Description
PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PostGIS | address_standardizer | ≤ 3.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | address-standardizer | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | address-standardizer | No fix yet | — |
References
- Unvalidated Weight in rules_add_rule() at v3.7.0 technical-description
- Out-of-bounds index into __load_value__ at v3.7.0 technical-description
- NEWS.md vendor-advisory
- Pull Request #6 issue-tracking patch
- Fix Commit patch
- Merge Commit patch
- https://github.com/postgis/address_standardizer product
- VulnCheck Advisory: PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight third-party-advisory