CVE-2026-105613: PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions

Q: Who can trigger the denial of service?

The vector indicates network reachability and no privileges, but user interaction is required. Exploitation targets a PostgreSQL backend through the extension's range-based dummy functions.

Q: What is the operational impact if exploitation succeeds?

A backend can exhaust memory and be OOM-killed when memory overcommit is enabled. This can trigger cluster-wide crash recovery.

Q: Which versions are affected and which version fixes the issue?

The issue is resolved in PostgreSQL Anonymizer 3.3.0 and later. The provided data does not identify the first affected version.

Published Oct 28, 2026

Updated

PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected Software

1 affected component

PostgreSQL Anonymizer PostgreSQL Anonymizer<3.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PostgreSQL Anonymizer to a version that resolves this vulnerability.
Fixed in 3.3.0

Event History

Oct 28, 2026

CVE Published

via MITRE·05:31 PM

Data Sourced

via MITRE·05:31 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can trigger the denial of service?

The vector indicates network reachability and no privileges, but user interaction is required. Exploitation targets a PostgreSQL backend through the extension's range-based dummy functions.

What is the operational impact if exploitation succeeds?