Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1uyFqE-005gRY-PK for pgsql-bugs@arkaria.postgresql.org; Mon, 15 Sep 2025 20:30:26 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1uyFqC-00DbVe-Gw for pgsql-bugs@arkaria.postgresql.org; Mon, 15 Sep 2025 20:30:25 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1uyFqC-00DbVW-7W for pgsql-bugs@lists.postgresql.org; Mon, 15 Sep 2025 20:30:25 +0000 Received: from mail-wr1-x431.google.com ([2a00:1450:4864:20::431]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.96) (envelope-from ) id 1uyFq8-0010PU-0J for pgsql-bugs@lists.postgresql.org; Mon, 15 Sep 2025 20:30:24 +0000 Received: by mail-wr1-x431.google.com with SMTP id ffacd0b85a97d-3eb08d8d9e7so944276f8f.0 for ; Mon, 15 Sep 2025 13:30:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cybertec.at; s=google; t=1757968220; x=1758573020; darn=lists.postgresql.org; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:to:from:subject:message-id:from:to:cc:subject:date :message-id:reply-to; bh=33N+zhgat2BUCwzFOFQNkU5mJsI0/qTXcesEhcVzahw=; b=QjBspJY3Huvi8Z+OKTOp6BagRBe9KsiL+kdttD9/8Ch3+AAqWGgZMfJqIaDjW3FCtP KQCRND+RSyR44fFQY8gPDlJYK/WE3M0jhJ8flt3b4d4rvnpeNfhmJV7vLvm3R77Z5sX4 NtHSZuqH6kxQENiITtLS1UnUWEO0ZDUFQzxYRtfhoVj+AHtRsYUrVW4Ic10+O83s5Aya 8QS+TmOM/fXTztEwbcpVcuwxVJdU6C6a71eDUBsicyfcy2aXHKHGwxCawT2y9DLMgYXm hcHCcdURBqvMkvzLzZcbDamZwf6XboiNfAdbqjEyGPurZgxq3V6lTqgOJZ5pDquOeOXX wB9A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1757968220; x=1758573020; h=mime-version:user-agent:content-transfer-encoding:references :in-reply-to:date:to:from:subject:message-id:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=33N+zhgat2BUCwzFOFQNkU5mJsI0/qTXcesEhcVzahw=; b=mSjNgp4obdglJfF2N06UjWy9wemkPNSJw5XluG5c+dmbzsQX+198m6cpYb0+daNNZv l6XN/pX/NqQz9cQZytomPwZ0ipP70dYMxa4z31uTTO4eZkvLetfsNInFxBOgdAQnnHLm uXzEo1+mDdZhDj7yJ1Yy5Tupf6MQNL6eaXneDYOgPw+5aAi0P53XX06ZkuJDgj7YtPIi 7ccxqYTxiBH6spF8Ai1sATQ9RIHfYAcR6HKrb7na90LyXsIiIdqCsEHkuhLc/ZqSInQr W1KbJr4MydCBwQXulC/lLJT8KpxYprE/JoILBIl3b5N7W3BhiOx3qLy2enBLVPWIqolH 9hIA== X-Forwarded-Encrypted: i=1; AJvYcCXFWCpSHDzTp5AfEZ7Lr9NNpQnfTu6omDzYTUFN95kxqa0uaF+z9DJr2a+WYwrWqPvq+IrSiCqrHH4i@lists.postgresql.org X-Gm-Message-State: AOJu0YwojOPggFLJc5V+fhkZgzNckIA5a9rc7K0VHUNC7gAqvk9B8PYS 8JySaai2D95H9KCK6aiRrB4n6Ywuvfe1UvDhLPmNTqPCJPDfSfIWetbLopECz5rD/oU= X-Gm-Gg: ASbGnctPfH91h3X4hTIlmR7vuYGFA/h41QS5WFowput0IVZL+vdNNxJpBhL0c1pmtHx 7XXEmYH8K9vpu6y2KCrB1yKs5ZhLN2hTiJoBoQ6RHCHy9N5xL5IoonBmD1xCPxwGvgAF1kFAhpN ALGtnRCgdp7UC0Xpw2Lsyx29VMz8RBRQci2+F+R9iZgTJF1uue1uICyRBW6tcTPYleRS7HYOlAI wOLft2p+wJYpPfz+wPyKirMG+99ow8u7eKlZGq6CKUoLwvSOlG3pHtbu9ZCJ4JAFacD4HtVGMw1 IXJEKaa6lqoVrxnIV3bSAAv5C6y+wSUHuHjFOf5dJCrybuh/bIYIYnWEkxbOhUPd/NLD1YT6FIN 3o7YHaJKcab66sYUYq8q/cNcUpaBGIOjayu7A3XJTOA0oSphc0YLu X-Google-Smtp-Source: AGHT+IHXgDbmFC9CdTch75598iYrQGSFO6MtYzU5l8HVYz4K7fi7Wki013LXjzbsrMFr0aQVyyMYIg== X-Received: by 2002:a05:6000:26cb:b0:3ec:4a0d:a09f with SMTP id ffacd0b85a97d-3ec4a0da415mr557789f8f.1.1757968220149; Mon, 15 Sep 2025 13:30:20 -0700 (PDT) Received: from laurenz.albe-K4N0CV00F97414D ([2001:871:255:30a:2403:9037:2d08:c2c]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-3e80da7f335sm12638311f8f.8.2025.09.15.13.30.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 15 Sep 2025 13:30:18 -0700 (PDT) Message-ID: <0513e4694c2f7264f469fa5febc1662001f0a903.camel@cybertec.at> Subject: Re: BUG #19054: Memory exhaustion vulnerability in PostgreSQL array operations leads to server crash From: Laurenz Albe To: sibowu@amazon.com, pgsql-bugs@lists.postgresql.org Date: Mon, 15 Sep 2025 22:30:17 +0200 In-Reply-To: <19054-b3e91211012e644a@postgresql.org> References: <19054-b3e91211012e644a@postgresql.org> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable User-Agent: Evolution 3.56.2 (3.56.2-2.fc42) MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Mon, 2025-09-15 at 20:00 +0000, PG Bug reporting form wrote: > PostgreSQL's array implementation can lead to server crashes due to > uncontrolled memory consumption during array operations. When performing > continuous array modifications within a loop, the server eventually exhau= sts > available memory and crashes, affecting all connected sessions. That's not a bug, that's a user error. For reliable operation, you have to disable Linux' memory overcommit. Then the kernel won't kill the database, but your query will receive an "out of memory" error and fail without any crashes. Yours, Laurenz Albe