PostgreSQL Anonymizer EUVD-2026-112285

The deployment must have the PostgreSQL Anonymizer extension installed and must expose or allow invocation of its range-based dummy/faking functions (versions before 3.3.0). The attacker must be able to execute SQL that calls such a function with an attacker-controlled, unconstrained (very large) range. The specific catastrophic outcome - OOM-kill of the backend and cluster-wide crash recovery - occurs when OS memory overcommit is enabled; without overcommit the allocation failure may be handled more gracefully. Limiting factors: requires reachability of the vulnerable functions and the ability to run SQL against the affected database, and the full cluster-crash impact is conditioned on the overcommit setting. The provided vector lists PR:N and UI:R, but neither is supported by the described trigger mechanism.

This is a medium-severity denial-of-service issue (CVSS 4.7), not a top-tier emergency. The supporting signals are thin and partly conflicting. No EPSS score is provided, CISA KEV status is NO, and there is no verified exploit code - only a vendor GitLab issue. The vuln.today decision label is 'this_month', consistent with a non-urgent DoS rather than act_now/emergency. The provided CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/A:L) has two tensions worth flagging: (1) PR:N (unauthenticated) conflicts with the mechanism, since triggering a range-based dummy/faking function requires the ability to execute SQL against a database where the PostgreSQL Anonymizer extension is installed - that normally implies at least some database access, so the practical privilege requirement is likely PR:L, verify against vendor masking configuration. (2) UI:R (user interaction required) is not explained anywhere in the description; the attacker appears to trigger the condition directly by issuing the query, so the UI:R flag is unverified from available sources. The description also states the catastrophic outcome (cluster-wide crash recovery) depends on OS memory overcommit being enabled - a conditional that the A:L rating arguably understates, since a full cluster crash-recovery outage affects every database and session. Net: a real but conditional availability risk for the narrow population running this extension, not a widespread or actively exploited threat.

An attacker able to execute SQL against a database using PostgreSQL Anonymizer calls a range-based dummy/faking function with an extremely large, unconstrained range, causing the backend to allocate unbounded memory. With OS memory overcommit enabled, the backend is OOM-killed, forcing the entire PostgreSQL cluster into crash recovery and a service outage. No verified public exploit code is available; only the vendor's GitLab issue describes the flaw.