CVE-2025-8713: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table
postgreSQL has been updated to version 16.10 which contains fixes for security vulnerabilities including CVE-2025-8713, CVE-2025-8714 and CVE-2025-8715
Other sources
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
— NVD
PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table
— Microsoft
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8713?
CVE-2025-8713 is classified as a medium severity vulnerability.
How do I fix CVE-2025-8713?
To fix CVE-2025-8713, upgrade PostgreSQL to versions 17.6, 16.10, 15.14, 14.19, or 13.22 or later.
What type of data can be accessed due to CVE-2025-8713?
CVE-2025-8713 allows unauthorized access to sampled data within views that should otherwise be restricted.
Which versions of PostgreSQL are affected by CVE-2025-8713?
CVE-2025-8713 affects PostgreSQL versions up to 17.6, 16.10, 15.14, 14.19, and 13.22.
Are row security policies effective against the CVE-2025-8713 vulnerability?
No, CVE-2025-8713 allows leakage of data that row security policies are intended to protect.