EUVD-2026-42867Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via hosting application (AV:N), but AT:P precondition (user input as channel name plus a reconnect) maps to AC:H; no confidentiality or integrity impact.
Primary rating from Vendor (6b3ad84c-e1a6-4bf7-a703-f496b71e49db).
CVSS VectorVendor: 6b3ad84c-e1a6-4bf7-a703-f496b71e49db
Lifecycle Timeline
2DescriptionCVE.org
SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection.
Postgrex.Notifications sanitizes channel names with quote_channel/1, which doubles double quotes so the name is safe inside a double-quoted identifier. This protects the single-statement LISTEN and UNLISTEN paths. On every (re)connect, however, handle_connect/1 replays all registered channels at once by concatenating their LISTEN statements and wrapping them in a dollar-quoted anonymous code block (DO $$BEGIN ... END$$). quote_channel/1 does not escape the $$ dollar-quote delimiter that opens and closes this block.
The listen/3 guards only reject null bytes and names longer than 63 bytes, so a channel name containing $$ passes validation unchanged. Once such a name is embedded, its $$ prematurely terminates the outer dollar-quoted string and PostgreSQL parses the remainder as additional top-level statements. Because handle_connect/1 runs on every (re)connect, the malformed replay query is rejected each time and the notification connection never re-establishes its subscriptions, silently dropping notifications for every channel sharing that connection.
An application is affected when it passes untrusted input (for example a tenant or user identifier) as a channel name to Postgrex.Notifications.listen/3. The double-quote doubling prevents forming a fully valid injected statement, so arbitrary SQL execution is not possible, but the corrupted query reliably breaks the shared notification connection for all tenants, resulting in denial of service.
This issue affects postgrex: from 0.16.0 before 0.22.3.
AnalysisAI
SQL injection in Postgrex.Notifications' reconnect replay path allows an attacker who can supply untrusted input as a PostgreSQL LISTEN channel name to corrupt the shared notification connection, silently dropping all channel subscriptions and causing persistent denial of service of the notification subsystem. Affected versions are postgrex 0.16.0 through 0.22.2 in the Elixir ecosystem. No arbitrary SQL execution is possible due to double-quote escaping, and no public exploit or CISA KEV listing exists; the CVSS 4.0 base score of 2.1 reflects the constrained, precondition-heavy impact.
Technical ContextAI
Postgrex is the primary Elixir/Erlang client library for PostgreSQL, and Postgrex.Notifications provides an asynchronous subscription mechanism built on PostgreSQL's LISTEN/UNLISTEN protocol. The root cause (CWE-89, SQL Injection) lies in the reconnect path: handle_connect/1 replays all registered channels by concatenating individual LISTEN statements inside a dollar-quoted anonymous PL/pgSQL block of the form DO $$BEGIN ... END$$. The sanitization function quote_channel/1 correctly doubles double-quote characters, protecting the single-statement LISTEN and UNLISTEN paths, but it does not escape or reject the $$ delimiter sequence. PostgreSQL's dollar-quoting treats a literal $$ as both an opening and closing delimiter, so a channel name containing $$ prematurely ends the outer dollar-quoted string on the server side, and PostgreSQL parses whatever follows as additional top-level SQL statements. Because handle_connect/1 runs on every reconnect, the corrupted query is re-submitted each time the connection is re-established, preventing the notification connection from ever successfully replaying its subscriptions. The listen/3 guard rejects only null bytes and names longer than 63 bytes, allowing $$ to pass unchallenged.
RemediationAI
Upgrade postgrex to version 0.22.3 or later, which contains the fix in commit 795c6062f62c4394272ff4b89170688857b4f841 that extends quote_channel/1 to sanitize or reject the $$ dollar-quote delimiter sequence. The vendor advisory is at https://github.com/elixir-ecto/ecto/security/advisories/GHSA-4mw9-4qgj-m97w. If an immediate upgrade is not feasible, the most effective compensating control is to sanitize channel names at the application boundary before passing them to Postgrex.Notifications.listen/3, specifically by rejecting or stripping any string containing the two-character sequence $$; this is a simple pattern match and does not require database interaction. A secondary control is to restrict which values can be used as channel names to a known-safe allowlist (e.g., prefixed UUIDs or hashed identifiers), eliminating attacker influence over the raw channel string. Do not rely solely on the existing null-byte and length guards in listen/3, as they do not cover this delimiter sequence.
More in PostgreSQL
View allPostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() improperl
An issue was discovered in Appsmith before 1.52. Rated critical severity (CVSS 9.8), this vulnerability is remotely expl
Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows re
Unauthenticated arbitrary file write in Splunk Enterprise (below 10.2.4 and 10.0.7) and Splunk Cloud Platform (below 10.
Unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets remote attackers execute arbitrar
PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allow
The build_tablename function in pgsql.c in the PostgreSQL (aka pgsql) extension in PHP through 5.6.7 does not validate t
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_serve
Unauthenticated SQL injection in Vendure Shop API allows remote attackers to execute arbitrary SQL commands against the
Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Hard-coded default PostgreSQL credentials shipped in the docker-compose.yaml of langgenius Dify through version 1.5.1 al
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today