Executive brief
PostGIS address_standardizer is a PostgreSQL extension that parses street addresses. It fails to validate the Weight parameter in rule tables, allowing attackers to insert malicious rows that crash the PostgreSQL backend process and terminate all active database sessions, causing a denial of service.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in PostGIS address_standardizer through version 3.7.0. The load_value array is indexed using an unvalidated Weight parameter from caller-supplied rules tables. Attackers can craft rows with out-of-range Weight values to trigger out-of-bounds memory reads. This requires access to insert or modify rule table data, but no authentication bypass is needed if the attacker already has database write privileges. Exploitation causes the PostgreSQL backend process to crash, terminating all cluster sessions. Version 3.7.1dev includes a fix that rejects out-of-range rule weights before they can be used as array indexes.
Affected products
- PostGIS address_standardizer through 3.7.0
Timeline
- 2026-09-13: disclosed
- 2026: patched: Version 3.7.1dev includes fix to reject out-of-range rule weights