Database

In PostgreSQL versions before 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 a medium severity vulnerability CVE‑2025‑12818 was discovered in the libpq client library. An integer wraparound issue in multiple libpq functions can cause undersized memory allocations and out-of-bounds writes by hundreds of megabytes. This flaw can lead to application crashes due to segmentation faults and potential memory corruption. To fix this vulnerability, users should upgrade to PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, or 13.23 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12818.

In PostgreSQL versions before 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 a low severity vulnerability CVE‑2025‑12817 was found in the CREATE STATISTICS command. Missing schema CREATE privilege checks allow a table owner to cause denial of service against other CREATE STATISTICS users by creating statistics in any schema, causing later CREATE STATISTICS commands with the same name by authorized users to fail. To fix this vulnerability, users should upgrade to PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, or 13.23 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12817.

In pgAdmin versions up to and including 9.9 a high severity vulnerability CVE-2025-12765 was detected. This vulnerability allows attackers to bypass TLS certificate verification in the LDAP authentication flow, potentially enabling unauthorized access through a man-in-the-middle attack. To fix this vulnerability, users should upgrade pgAdmin to version 10.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12765.

In pgAdmin versions up to and including 9.9 a high severity vulnerability CVE-2025-12764 was detected. This vulnerability allows attackers to perform LDAP injection by supplying specially crafted usernames containing LDAP control characters. Successful exploitation can cause the LDAP server and client to process excessive data, potentially leading to a denial of service (DoS). To fix this vulnerability, users should upgrade pgAdmin to version 10.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12764.

In pgAdmin versions up to and including 9.9 a medium severity vulnerability CVE-2025-12763 was detected. This vulnerability allows attackers to execute arbitrary system commands on Windows systems due to improper use of the shell=True parameter during backup and restore operations. By supplying specially crafted file paths, attackers can achieve command injection and gain unauthorized control of the affected system. To fix this vulnerability, users should upgrade pgAdmin to version 10.0 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12763.

In pgAdmin versions up to and including 9.9 a critical vulnerability CVE-2025-12762 was identified. When running in server mode, pgAdmin is vulnerable to remote code execution (RCE) during restore operations from PLAIN-format SQL dump files. An attacker could exploit this flaw to inject and execute arbitrary commands on the system hosting pgAdmin, compromising both the database management environment and underlying server data. Users are strongly advised to upgrade to pgAdmin version 10.0 or later to mitigate this issue. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-12762.

In Redis versions 8.2.0 through 8.2.2 a high severity vulnerability CVE-2025-62507 was detected. This vulnerability allows remote attackers to trigger a stack buffer overflow during execution of the XACKDEL command, which may potentially lead to remote code execution. To fix this vulnerability, users should upgrade to Redis version 8.2.3 or later. For more details, visit https://avd.aquasec.com/nvd/2025/cve-2025-62507.

In Redis versions 8.2.1 and below a high severity vulnerability CVE-2025-46817 was detected. Authenticated users can use specially crafted Lua scripts to trigger an integer overflow that may lead to remote code execution. This issue affects all Redis versions with Lua scripting enabled. To address this issue, users should upgrade Redis to version 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-46817.

In Redis versions 8.2.1 and below a high severity vulnerability CVE-2025-49844 was detected. Authenticated users can use a specially crafted Lua script to manipulate the garbage collector, triggering a use-after-free condition that may lead to remote code execution. This issue affects all Redis versions with Lua scripting enabled. To address this issue, users should upgrade Redis to version 8.2.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2025-49844.