Vulnerability · Published May 8, 2025 · Assigned by PostgreSQL
CVE-2025-4207PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation
Medium 5.9
In plain English
A medium-severity security flaw in PostgreSQL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.8%top 44.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte over-read can elicit process termination. This affects the database server and also libpq. Versions before PostgreSQL 17.5, 16.9, 15.13, 14.18, and 13.21 are affected.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:8 | pg_repack | 1.5.1-1.module_el8.10.0+3930+ecf33554 | ALSA-2025:14899 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+3095+ee60d910 | ALSA-2025:15021 |
| AlmaLinux:8 | pg_repack | 1.4.8-1.module_el8.9.0+3706+885c732e | ALSA-2025:15022 |
| AlmaLinux:8 | pg_repack | 1.4.6-3.module_el8.6.0+2760+1746ec94 | ALSA-2025:15021 |
| AlmaLinux:9 | pg_repack | 1.5.1-1.module_el9.6.0+146+c54fdeca | ALSA-2025:14827 |
| AlmaLinux:9 | pg_repack | 1.4.8-2.module_el9.5.0+119+18833d03 | ALSA-2025:14862 |
| AlmaLinux:8 | pgaudit | 16.0-1.module_el8.10.0+3798+606ebb9f | ALSA-2025:14899 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+2760+1746ec94 | ALSA-2025:15021 |
| AlmaLinux:8 | pgaudit | 1.7.0-1.module_el8.9.0+3706+885c732e | ALSA-2025:15022 |
| AlmaLinux:8 | pgaudit | 1.5.0-1.module_el8.6.0+3095+ee60d910 | ALSA-2025:15021 |
| AlmaLinux:9 | pgaudit | 16.0-1.module_el9.4.0+66+eb9878bc | ALSA-2025:14827 |
| AlmaLinux:9 | pgaudit | 1.7.0-1.module_el9.3.0+52+21733919 | ALSA-2025:14862 |
| AlmaLinux:9 | pgvector | 0.6.2-2.module_el9.6.0+167+4e561146 | ALSA-2025:14827 |
| AlmaLinux:8 | postgres-decoderbufs | 2.4.0-1.Final.module_el8.10.0+3798+606ebb9f | ALSA-2025:14899 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+2760+1746ec94 | ALSA-2025:15021 |
| AlmaLinux:8 | postgres-decoderbufs | 1.9.7-1.Final.module_el8.9.0+3706+885c732e | ALSA-2025:15022 |
| AlmaLinux:8 | postgres-decoderbufs | 0.10.0-2.module_el8.6.0+3095+ee60d910 | ALSA-2025:15021 |
| AlmaLinux:9 | postgres-decoderbufs | 1.9.7-1.Final.module_el9.3.0+52+21733919 | ALSA-2025:14862 |
| AlmaLinux:9 | postgres-decoderbufs | 2.4.0-1.Final.module_el9.4.0+66+eb9878bc | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:9 | postgresql | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-contrib | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-contrib | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-contrib | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:9 | postgresql-contrib | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-contrib | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-docs | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-docs | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-docs | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:9 | postgresql-docs | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-docs | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-plperl | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-plperl | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-plperl | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:9 | postgresql-plperl | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-plperl | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-plpython3 | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-plpython3 | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-plpython3 | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:9 | postgresql-plpython3 | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-plpython3 | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-pltcl | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-pltcl | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-pltcl | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:9 | postgresql-pltcl | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-pltcl | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-private-devel | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-private-devel | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:9 | postgresql-private-devel | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-private-devel | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-private-libs | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-private-libs | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:9 | postgresql-private-libs | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-private-libs | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-server | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-server | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-server | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:9 | postgresql-server | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-server | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-server-devel | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-server-devel | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-server-devel | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:9 | postgresql-server-devel | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-server-devel | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-static | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-static | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-static | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:9 | postgresql-static | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-static | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:8 | postgresql-test | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-test | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-test | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:9 | postgresql-test | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-test | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:10 | postgresql-test-rpm-macros | 16.10-1.el10_0 | ALSA-2025:14826 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-test-rpm-macros | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:9 | postgresql-test-rpm-macros | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-test-rpm-macros | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-upgrade | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-upgrade | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:8 | postgresql-upgrade | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:9 | postgresql-upgrade | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| AlmaLinux:9 | postgresql-upgrade | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:8 | postgresql-upgrade-devel | 13.22-1.module_el8.10.0+4042+cb252986 | ALSA-2025:15021 |
| AlmaLinux:8 | postgresql-upgrade-devel | 15.14-1.module_el8.10.0+4041+afd30bb4 | ALSA-2025:15022 |
| AlmaLinux:8 | postgresql-upgrade-devel | 16.10-1.module_el8.10.0+4038+0fbad93c | ALSA-2025:14899 |
| AlmaLinux:9 | postgresql-upgrade-devel | 15.14-1.module_el9.6.0+176+c508cfa2 | ALSA-2025:14862 |
| AlmaLinux:9 | postgresql-upgrade-devel | 16.10-1.module_el9.6.0+174+80cb77f0 | ALSA-2025:14827 |
| Alpine:v3.20 | postgresql15 | 15.13-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.21 | postgresql15 | 15.13-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.22 | postgresql15 | 15.13-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.20 | postgresql16 | 16.9-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.21 | postgresql16 | 16.9-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.22 | postgresql16 | 16.9-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.23 | postgresql16 | 16.9-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.24 | postgresql16 | 16.9-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.21 | postgresql17 | 17.5-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.22 | postgresql17 | 17.5-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.23 | postgresql17 | 17.5-r0 | ALPINE-CVE-2025-4207 |
| Alpine:v3.24 | postgresql17 | 17.5-r0 | ALPINE-CVE-2025-4207 |
| Debian:12 | postgresql-15 | 15.13-0+deb12u1 | DEBIAN-CVE-2025-4207 |
| Debian:13 | postgresql-17 | 17.5-1 | DEBIAN-CVE-2025-4207 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.18-0ubuntu0.22.04.1 | USN-7520-1 |
| Ubuntu:22.04:LTS | postgresql-14 | 14.18-0ubuntu0.22.04.1 | UBUNTU-CVE-2025-4207 |
| Ubuntu:24.04:LTS | postgresql-16 | 16.9-0ubuntu0.24.04.1 | UBUNTU-CVE-2025-4207 |
| Ubuntu:24.04:LTS | postgresql-16 | 16.9-0ubuntu0.24.04.1 | USN-7520-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | PostgreSQL | 17 – before 17.516 – before 16.915 – before 15.1314 – before 14.180 – before 13.21 |
Weakness: CWE-126 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H