GHSA-qhmr-5339-q33r: psqlODBC large-object read overflows the application buffer

Q: Who is exposed to this issue?

Applications using psqlODBC versions before 18.00.0006 are exposed when they fetch a large-object column from a server that is not trusted under the current SSL settings, or when a man-in-the-middle can alter the server response.

Q: What does an attacker need to exploit it?

The attacker needs to control or modify the response to a large-object read. No credentials are required, but a user must cause the client application to fetch a large-object column.

Q: Are default SSL protections sufficient?

The issue specifically applies when the server is not trusted under the current SSL settings or when a man-in-the-middle can interfere with the connection. The provided information does not establish which SSL configurations are safe by default.

Q: How can I determine whether an application is affected?

Check whether it uses psqlODBC before version 18.00.0006 and fetches PostgreSQL large-object columns. Such reads can trigger the vulnerable loread response handling.

Published Nov 2, 2026

Updated

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it. Versions before psqlODBC 18.00.0006 are affected.

Affected Software

1 affected component

PostgreSQL psqlODBC<18.00.0006

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade psqlODBC to a version that resolves this vulnerability.
Fixed in 18.00.0006

Event History

Nov 2, 2026

CVE Published

via OSV·07:09 PM

Data Sourced

via OSV·07:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using psqlODBC versions before 18.00.0006 are exposed when they fetch a large-object column from a server that is not trusted under the current SSL settings, or when a man-in-the-middle can alter the server response.

What does an attacker need to exploit it?

The attacker needs to control or modify the response to a large-object read. No credentials are required, but a user must cause the client application to fetch a large-object column.

Are default SSL protections sufficient?

The issue specifically applies when the server is not trusted under the current SSL settings or when a man-in-the-middle can interfere with the connection. The provided information does not establish which SSL configurations are safe by default.

How can I determine whether an application is affected?

Check whether it uses psqlODBC before version 18.00.0006 and fetches PostgreSQL large-object columns. Such reads can trigger the vulnerable loread response handling.

GHSA-qhmr-5339-q33r: psqlODBC large-object read overflows the application buffer

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default SSL protections sufficient?

How can I determine whether an application is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are default SSL protections sufficient?

How can I determine whether an application is affected?