Address Standardizer
Monthly
Out-of-bounds read in PostGIS address_standardizer through 3.7.0 allows authenticated database users to crash the entire PostgreSQL cluster by supplying rule rows with out-of-range Weight values. The Weight field is consumed directly as an array index into the load_value array inside rules_add_rule() (src/gamma.c:338) without any bounds validation, so a Weight of -1 or >= NUMBER_OF_WEIGHTS triggers an OOB read that terminates the PostgreSQL backend process and drops all active cluster sessions. No public exploit code has been identified at time of analysis; patch commits are available upstream.
Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.
Out-of-bounds read in PostGIS address_standardizer through 3.7.0 allows authenticated database users to crash the entire PostgreSQL cluster by supplying rule rows with out-of-range Weight values. The Weight field is consumed directly as an array index into the load_value array inside rules_add_rule() (src/gamma.c:338) without any bounds validation, so a Weight of -1 or >= NUMBER_OF_WEIGHTS triggers an OOB read that terminates the PostgreSQL backend process and drops all active cluster sessions. No public exploit code has been identified at time of analysis; patch commits are available upstream.
Out-of-bounds write in the PostGIS address_standardizer extension through 3.7.0 allows a low-privileged database user to trigger memory corruption in the PostgreSQL server process by supplying a malicious rules table to the standardize_address() function. Missing bounds validation on the classification Type field in gamma.c permits values outside the valid range to be used as raw array indices into an internal output-link table, writing attacker-influenced data to adjacent memory. Publicly available exploit code demonstrates successful exploitation against managed cloud PostgreSQL environments including NeonDB and Supabase; no CISA KEV listing is present at time of analysis.