CVE-2025-12817: PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Other sources
PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-12817 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-12818 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 13.23
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12817?
CVE-2025-12817 has been classified as a medium severity vulnerability.
How do I fix CVE-2025-12817?
To mitigate CVE-2025-12817, ensure that user permissions and privileges are properly configured to control access to the CREATE STATISTICS command.
Who is affected by CVE-2025-12817?
CVE-2025-12817 affects users of PostgreSQL versions up to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23.
What does CVE-2025-12817 allow an attacker to do?
CVE-2025-12817 allows a table owner to create statistics in any schema, potentially leading to a denial of service against other CREATE STATISTICS users.
Is there a known exploit for CVE-2025-12817?
As of now, there are no publicly available exploits specifically targeting CVE-2025-12817.