{"id":"CVE-2026-105613","title":"PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions","summary":"PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash reco…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-789"],"vendor":"DALIBO","product":"PostgreSQL Anonymizer","affected":["postgresql_anonymizer >= 1 < 3.3.0"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:31:45.232Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105613","references":[{"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/690"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T18:15:46.390Z","slug":"CVE-2026-105613","body":"## Overview\n\nPostgreSQL Anonymizer's range-based dummy functions dont constraint the range size. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.\n\n## Affected\n\n- `postgresql_anonymizer >= 1 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRevoke execution rights on the range-based dummy functions or drop them.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}