Vulnerability details

CVE-2025-1094

PostgreSQL

PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

CVSS 3.1

8.1High

Official description

Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.

CVSS scores

Score	Version	Source	Vector
8.1High	3.1	CVEProject cvelistV5 (CNA) (PostgreSQL)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
—	PostgreSQL	v < 13.19	CVEProject cvelistV5 (CNA)
—	PostgreSQL	14 ≤ v < 14.16	CVEProject cvelistV5 (CNA)
—	PostgreSQL	15 ≤ v < 15.11	CVEProject cvelistV5 (CNA)
—	PostgreSQL	16 ≤ v < 16.7	CVEProject cvelistV5 (CNA)
—	PostgreSQL	17 ≤ v < 17.3	CVEProject cvelistV5 (CNA)

References and advisories

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2025-02-13
Last updated: 2026-11-04
State: Published
Assigner (CNA): PostgreSQL
Kolun priority: 37 · Medium

Exploit prediction (EPSS)

90.03%

Probability of exploitation in 30 days

99.7%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-149
Improper Neutralization of Quoting Syntax