USN-9047-1: asyncpg vulnerability
Published Nov 11, 2026
·Updated
It was discovered that asyncpg incorrectly handled certain array data returned by a PostgreSQL server. A remote attacker controlling a PostgreSQL server could possibly use this issue to cause asyncpg to crash, resulting in a denial of service, or execute arbitrary code.
Affected Software
2 affected componentsFixes available
ubuntu/asyncpg<0.13.0-1ubuntu3+esm1
0.13.0-1ubuntu3+esm1
ubuntu/asyncpg<0.20.0-1ubuntu0.1~esm1
0.20.0-1ubuntu0.1~esm1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/asyncpgto a version that resolves this vulnerability.Fixed in 0.13.0-1ubuntu3+esm1 - Upgrade
Upgrade
ubuntu/asyncpgto a version that resolves this vulnerability.Fixed in 0.20.0-1ubuntu0.1~esm1
Event History
Nov 11, 2026
Advisory Published
via OSV·06:31 PM
Data Sourced
via OSV·06:31 PM
DescriptionAffected Software