Description

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-13T12:17:16.400Z",
  "pubdate": "2026-09-13T12:17:16.400Z",
  "executiveSummary": "This vulnerability is an out-of-bounds read flaw identified in the PostGIS address_standardizer extension. It affects versions up to and including 3.7.0.\nThe vulnerability arises from the failure to validate the Weight parameter provided in caller-supplied rules tables. An attacker can craft malicious rule rows containing out-of-range Weight values, which are subsequently used as array indices when accessing the load_value array.\nSuccessful exploitation of this flaw leads to memory access violations, triggering a crash of the PostgreSQL backend process. Because PostgreSQL manages processes per session, this crash results in the immediate termination of all active sessions within the database cluster, leading to a significant denial-of-service (DoS) condition.\nThe vulnerability does not require complex network conditions, but it does necessitate the ability to insert or modify data in a rules table processed by the address_standardizer extension. The primary risk is the loss of service availability caused by the unstable memory operations performed by the backend.\nThis flaw underscores the critical need for strict input sanitization and boundary checking when processing user-defined configuration or rule data in PostgreSQL extensions.",
  "technicalDetails": "The vulnerability resides within the logic of the address_standardizer component of PostGIS, specifically where it parses and processes data from user-supplied rules tables. The extension expects a Weight parameter, which it subsequently employs as an index to access a fixed-size internal structure known as the load_value array.\nThe root cause is a lack of input validation on the Weight field. The application assumes the provided Weight value conforms to the predefined bounds of the load_value array. However, the software fails to verify that the value lies within the permitted range before it is used as an index into the memory segment where the array resides. This is a classic out-of-bounds access scenario.\nThe attack flow begins when an attacker, typically a user with permissions to insert or modify entries in the rule tables accessed by address_standardizer, introduces a specially crafted rule row. The Weight column in this row is set to a value that falls outside the allocated memory range of the load_value array. When the extension logic attempts to perform a lookup using this malicious Weight, the indexing operation calculates an address that points to unintended memory locations.\nUpon triggering this index operation, the PostgreSQL backend process attempts to read data from the illegal memory address. This action results in a memory access violation or a segmentation fault, depending on the architecture and the memory map of the specific environment. Consequently, the operating system kernel sends a termination signal to the backend process. Because the backend is responsible for handling database transactions and managing shared memory state, the abrupt termination of the process forces the entire PostgreSQL cluster to handle the instability, resulting in the immediate drop of all current database connections and a service-wide outage.\nThe vulnerability affects PostGIS versions up to and including 3.7.0. It requires the attacker to have sufficient database privileges to manipulate the rules tables, making this an authenticated attack vector. No complex exploit payload is required beyond the submission of the invalid numeric value, as the memory corruption is a direct consequence of the flawed indexing logic itself. Post-exploitation impact is limited to denial-of-service via system crash, as the current reporting indicates memory reads rather than arbitrary code execution or privilege escalation."
}