The vulnerability arises from cleartext storage in PostgreSQL's pgcrypto module when certain ciphers are disabled in OpenSSL. Because of this, encrypted data can be decrypted incorrectly but still produce output, losing the integrity protection normally provided by the Modification Detection Code (MDC). Affected functions include pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, and their bytea variants. The OpenSSL version and configuration determine which ciphers are disabled, influencing the vulnerability's presence. This issue affects PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24.

An attacker can recover cleartext data by observing faulty ciphertext due to the acceptance of encrypted data that decrypts successfully even with incorrect keys. This undermines the modest protection offered by the Modification Detection Code (MDC), potentially exposing sensitive information stored using pgcrypto encryption functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should review their OpenSSL configuration to ensure no disabled ciphers that could trigger this vulnerability are in use and consider limiting the use of affected pgcrypto functions. Monitor PostgreSQL vendor advisories for updates and apply patches promptly once released.