VDB
ALPINE-CVE-2025-12817
ALPINE-CVE-2025-12817
PUBLISHED
CVSS 3.0999999046325684 LOW
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Risk Scores
CVSS v3.1
3.0999999046325684
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.22 | postgresql17 | 17.4-r0, 17.4-r2, 17.4-r3 |
| Alpine:v3.20 | postgresql16 | 16.2-r3, 16.2-r0, 16.1-r0 |
| Alpine:v3.22 | postgresql16 | 16.0-r1, 16.9-r0, 16.8-r4 |
| Alpine:v3.23 | postgresql17 | 17.0-r0, 0, 17.0-r0 |
| Alpine:v3.21 | postgresql16 | 16.0-r2, 16.0-r1, 16.0-r0 |
| Alpine:v3.20 | postgresql15 | 15.4-r1, 15.2-r2, 15.1-r1 |
| Alpine:v3.23 | postgresql18 | 18.0-r0, 0, 18.0-r0 |
| Alpine:v3.21 | postgresql17 | 0, 17.0-r0, 17.0-r1 |
| Alpine:v3.19 | postgresql15 | 15.3-r1, 15.3-r0, 15.2-r4 |
| Alpine:v3.19 | postgresql16 | 16.8-r0, 0, 0 |
Timeline
- Nov 13, 2025 CVE Published
- Dec 3, 2025 CVE Updated
- Apr 30, 2026 Distribution Patch