CVE-2025-8713: postgresql-17

Vulnerability summary

CVE-2025-8713 is a low (CVSS 3.1) vulnerability in postgresql-17. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 13.6% of scored vulnerabilities.

Timeline

1. 14-08-2025
   PublishedVulnerability first disclosed.
2. 14-08-2025
   Last modifiedVulnerability information updated.

Description

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

• CWE-1230Exposure of Sensitive Information Through MetadataThe product prevents direct access to a resource containing sensitive information, but it does not sufficiently limit access to metadata that is derived from the original, sensitive information.