agora inbox for pgsql-committers@postgresql.org
help / color / mirror / Atom feedFrom: Noah Misch <noah@leadboat.com>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Obstruct EXTRACT() field name deparse injection.
Date: Mon, 10 Aug 2026 13:41:31 +0000
Message-ID: <E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org> (raw)
Obstruct EXTRACT() field name deparse injection.
The parser accepts any string as an EXTRACT() field name, but
deparsing does not quote and escape it accordingly. To fix, quote
and escape the field name during deparsing as needed. It might be
a good idea to validate the field name during parsing and
deparsing, too, but that is left as a future exercise.
Reported-by: Ben Morris in collaboration with Claude and Anthropic Research
Author: Nathan Bossart <nathandbossart@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Etsuro Fujita <etsuro.fujita@gmail.com>
Security: CVE-2026-15741
Backpatch-through: 14
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/44ea6764be76ebb3d8dd01d60b5751acbe7b87d3
Author: Nathan Bossart <nathan@postgresql.org>
Modified Files
--------------
src/backend/utils/adt/ruleutils.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
view thread (6+ messages)
Message-ID: <E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org>
Permalink: ../E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org/
Also on: postgresql.org/message-id/E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: noah@leadboat.com, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Obstruct EXTRACT() field name deparse injection.
In-Reply-To: <E1wtQFv-00000000yKz-1CML@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox