CVE-2025-8713
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Version Information
| Affected branch | Introduced | Fixed In | Fix Published |
|---|---|---|---|
| 13 | — | 13.22 | 2025-08-14 |
| 14 | — | 14.19 | 2025-08-14 |
| 15 | — | 15.14 | 2025-08-14 |
| 16 | — | 16.10 | 2025-08-14 |
| 17 | — | 17.6 | 2025-08-14 |
CVSS 3.0
| Overall Score | 3.1 |
|---|---|
| Component | core server |
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
First published: 2025-08-14
Historical source observations
These dated records preserve the original source claims separately from the reviewed fix list.
center · 2026-10-03 12:08:35.169032+08
- PostgreSQL 17 · Original minor coordinate: 6
- PostgreSQL 16 · Original minor coordinate: 10
- PostgreSQL 15 · Original minor coordinate: 14
- PostgreSQL 14 · Original minor coordinate: 19
- PostgreSQL 13 · Original minor coordinate: 22
pgweb · 2026-10-03 12:08:55.967155+08
- PostgreSQL 17 · Original minor coordinate: 6
- PostgreSQL 16 · Original minor coordinate: 10
- PostgreSQL 15 · Original minor coordinate: 14
- PostgreSQL 14 · Original minor coordinate: 19
- PostgreSQL 13 · Original minor coordinate: 22