CVE-2026-110182: PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data
PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partialemail() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQL Anonymizerto a version that resolves this vulnerability.Fixed in 3.3.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs low-privileged access to invoke the affected anon.partial() or anon.partial_email() functions. The vulnerability is remotely reachable and requires no user interaction.
Under what conditions can data be exposed?
The affected masking functions can reveal the entire value when the input data is small enough. The available information does not define a specific length threshold.
What versions are affected or fixed?
The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later. Deployments running an earlier version should be treated as potentially affected.