Vulnerability · Published Jun 17, 2022 · Assigned by snyk

CVE-2022-25852Denial of Service (DoS)

High 7.5

In plain English

A high-severity security flaw in libpq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.4%top 27.4% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	libpq	1.8.10	GHSA-j32j-2hxv-rqf7
npm	pg-native	3.0.1	GHSA-j32j-2hxv-rqf7

Affected products (as reported)

Vendor	Product	Versions
n/a	pg-native	0 – before unspecified
n/a	libpq	0 – before unspecified

References

https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365 x_refsource_MISC
https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366 x_refsource_MISC