CVE-2025-12817

PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege

Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.

The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.

Version Information

Affected Version Fixed In Fix Published
18 18.1 Nov. 13, 2025
17 17.7 Nov. 13, 2025
16 16.11 Nov. 13, 2025
15 15.15 Nov. 13, 2025
14 14.20 Nov. 13, 2025
13 13.23 Nov. 13, 2025

For more information about PostgreSQL versioning, please visit the versioning page.

CVSS 3.0

Overall Score 3.1
Component core server
Vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L

Reporting Security Vulnerabilities

If you wish to report a new security vulnerability in PostgreSQL, please send an email to security@postgresql.org.

For reporting non-security bugs, please see the Report a Bug page.