{"id":"CVE-2026-110183","title":"PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking","summary":"PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manua…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvssSource":"cna","cwe":["CWE-202"],"vendor":"DALIBO","product":"PostgreSQL Anonymizer","affected":["postgresql_anonymizer >= 1 < 3.3.0"],"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T17:31:53.824Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110183","references":[{"url":"https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722"}],"tags":["cve.org"],"ingestedAt":"2026-10-28T18:15:46.390Z","slug":"CVE-2026-110183","body":"## Overview\n\nPostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.\n\n## Affected\n\n- `postgresql_anonymizer >= 1 < 3.3.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nRun the ANALYZE command after static masking.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}