PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege
Vulnerability Description
Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema. A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail. Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-12817
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- The PostgreSQL project thanks Jelte Fennema-Nio for reporting this problem.
