DEBIAN-CVE-2026-120060: Medium severity debian/psqlodbc vulnerability

Published Nov 2, 2026

Updated

psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.

Affected Software

3 affected components

debian/psqlodbc*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade psqlODBC to a version that resolves this vulnerability.
Fixed in 18.00.0006

Event History

Nov 2, 2026

CVE Published

via OSV·07:18 PM

Data Sourced

via OSV·07:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using Debian psqlODBC versions before 18.00.0006 are exposed when they connect to a PostgreSQL server that is not trusted under the current SSL settings. The issue affects the client, so the malicious or untrusted server supplies the data that triggers it.

What does an attacker need to exploit it?

An attacker needs to cause a vulnerable psqlODBC client to connect to a server they control or otherwise do not trust under the configured SSL settings. Exploitation also requires client activity that reaches the affected handling of bulk-operation row counts, statistics index keys, or truncated bytea escape sequences.

What is the impact of successful exploitation?

A malicious server can crash the psqlODBC client or cause it to read memory out of bounds. The provided severity vector indicates low confidentiality impact and high availability impact, with no integrity impact.

How can this be remediated?

Upgrade psqlODBC to version 18.00.0006 or later. If upgrading cannot happen immediately, avoid connecting affected clients to PostgreSQL servers that are not trusted under the current SSL settings.

DEBIAN-CVE-2026-120060: Medium severity debian/psqlodbc vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact of successful exploitation?

How can this be remediated?