Skip to content
fr Sign in
7.5 High

CVE-2026-120058 psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each…

Description

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple records past the end of the heap allocation. A keyset reply with fewer columns than the key fields also underflows the unsigned field count. This is reachable with UseDeclareFetch enabled. Versions before psqlODBC 18.00.0006 are affected.

Affected products and versions

Product Affected versions Fixed in
psqlODBC 18.00 earliest → < 18.00.0006 18.00.0006

References

Timeline

  1. Published
  2. Last modified

Other CVEs of psqlODBC

The 12 CVEs of psqlODBC →
CVE-2026-120067 For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to… 5.9 Medium CVE-2026-120066 On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program… 5.3 Medium CVE-2026-120065 For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to… 7.1 High CVE-2026-120064 Several psqlODBC entry points use an application-supplied column number or row index as an array index without… 7.5 High
Track this CVE