Skip to content
CVE Tracker
Back

CVE-2026-120060

psqlODBC does not validate server-supplied counts and lengths

Medium5.9
Published
Updated
Reserved
Assigned by
PostgreSQL

Description

psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads up to two bytes past the end of a truncated escape sequence. A server not trusted under current SSL settings can crash the client or make it read out of bounds. Versions before psqlODBC 18.00.0006 are affected.

Scores

CVSS scores of CVE-2026-120060, by who scored it
Scored byCVSSScoreVector
PostgreSQLCNA (assigner)3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
NVDNVD · Awaiting Analysis3.1Medium5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:H
EPSS (exploitation in 30 days)
Not scored
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

Affected products

  • PostgreSQL · psqlODBC

    • affected < 18.00.0006

What to do

Solution: Upgrade to psqlODBC 18.00.0006 or later. The row count, the index-key count, and the octal escape length are checked before use.

Workaround: Connect only to servers authenticated with sslmode=verify-full or an equivalent GSS setting.

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .