CVE-2026-90775
PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight
CVSS 4.0 7.1 HIGHCVSS 3.1 6.5 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-90775
PublishedPostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-90775 · CVE overview and exploitation status
cve-program · CVE-2026-90775
- https://github.com/postgis/address_standardizer/blob/v3.7.0/src/gamma.c#L301-L311
- https://github.com/postgis/address_standardizer/blob/v3.7.0/src/analyze.c#L860
- https://github.com/postgis/address_standardizer/blob/e987949e0fccff6a0e7a6d3f86814d5c7a01f481/NEWS.md
- https://github.com/postgis/address_standardizer/pull/6
- https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a
- https://github.com/postgis/address_standardizer/commit/e987949e0fccff6a0e7a6d3f86814d5c7a01f481
- https://github.com/postgis/address_standardizer
- https://www.vulncheck.com/advisories/postgis-address-standardizer-through-3.7.0-out-of-bounds-read-via-unvalidated-rule-weight
Related changes
Linked by CVE identifierNo related changes are available here.