CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight
Attackers can crash the PostgreSQL backend by supplying invalid weight values in address standardization rules, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-90775?
CVE-2026-90775 is a high-severity denial of service vulnerability in PostGIS address_standardizer, published on 13 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.
Weakness: CWE-125
Which versions are affected by CVE-2026-90775?
How do I fix CVE-2026-90775?
No fix has been published for CVE-2026-90775 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-90775 being exploited?
There is no known exploitation of CVE-2026-90775 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-90775, GHSA-pjx8-ww25-pcf8, UBUNTU-CVE-2026-90775.