CVE-2025-12817 Details
Description
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
A denial-of-service vulnerability has been identified in PostgreSQL versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23. The issue arises from missing authorization in the CREATE STATISTICS command, which allows a table owner to disrupt other users' CREATE STATISTICS operations. This is achieved by creating statistics in any schema. If another user with the CREATE privilege later attempts to use the same name for statistics, the operation will fail.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 13, 2025CISA-ADP
Assessed Nov 13, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.postgresql.org/support/security/CVE-2025-12817/ | PostgreSQL | AdvisoryBroken LinkVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | PostgreSQL |
Affected Products
| Product | Versions |
|---|---|
| PostgreSQL | < 18.1 < 17.7 < 16.11 < 15.15 < 14.20 < 13.23 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | PostgreSQL |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 13, 2025 | New CVE Received | PostgreSQL |