CVE-2026-120057: High severity debian/psqlodbc vulnerability

Q: Which client deployments are exposed?

Applications using psqlODBC versions before 18.00.0006 are affected when they fetch a large-object column. The vulnerable component is the client process, not necessarily the database server.

Q: What must an attacker be able to do to exploit this?

The attacker must be able to make the client accept malicious server replies, either by operating a server that is not trusted under the current SSL settings or by acting as a man-in-the-middle. No client-side privileges are required, but user interaction is required according to the supplied severity vector.

Q: Is fetching a specific query result required?

Yes. Fetching any large-object column is sufficient to reach the vulnerable loread reply handling.

Q: What is the immediate mitigation if upgrading is not possible?

Avoid fetching large-object columns through the affected psqlODBC driver, and ensure SSL settings prevent connections to untrusted servers or interception by a man-in-the-middle.

Published Nov 2, 2026

Updated

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

Affected Software

11 affected componentsFixes available

debian/psqlodbc*

debian/psqlodbc<=1:13.02.0000-2, <=1:17.00.0004-2, <=1:18.00.0005-1

1:18.00.0006-1

ubuntu/psqlodbc*

Event History

Nov 2, 2026

CVE Published

via NVD·07:18 PM

Data Sourced

via NVD·07:18 PM

DescriptionSeverityWeakness

Data Sourced

via OSV·07:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which client deployments are exposed?

Applications using psqlODBC versions before 18.00.0006 are affected when they fetch a large-object column. The vulnerable component is the client process, not necessarily the database server.

What must an attacker be able to do to exploit this?

The attacker must be able to make the client accept malicious server replies, either by operating a server that is not trusted under the current SSL settings or by acting as a man-in-the-middle. No client-side privileges are required, but user interaction is required according to the supplied severity vector.

Is fetching a specific query result required?

Yes. Fetching any large-object column is sufficient to reach the vulnerable loread reply handling.

What is the immediate mitigation if upgrading is not possible?

Avoid fetching large-object columns through the affected psqlODBC driver, and ensure SSL settings prevent connections to untrusted servers or interception by a man-in-the-middle.

CVE-2026-120057: High severity debian/psqlodbc vulnerability

Affected Software

Event History

Frequently Asked Questions

Which client deployments are exposed?

What must an attacker be able to do to exploit this?

Is fetching a specific query result required?

What is the immediate mitigation if upgrading is not possible?

Company

Resources

Contact

Frequently Asked Questions

Which client deployments are exposed?

What must an attacker be able to do to exploit this?

Is fetching a specific query result required?

What is the immediate mitigation if upgrading is not possible?