CVE-2026-110183EUVD-2026-112296GHSA-5FHP-486M-M23R
PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The PostgreSQL Anonymizer extension, which is used to mask data in PostgreSQL databases, is affected. Statistics about the original, unmasked data can remain visible in the pg_stats view, potentially exposing some sensitive information until the table is analyzed again.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- DALIBO PostgreSQL Anonymizer
From 1 · fixed in 3.3.0