Threats affecting pkg:github/address_standardizer

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

CVE-2026-73514 is an out-of-bounds write vulnerability in the address_standardizer extension for PostGIS up to version 3.7.0. It allows a database user who can supply relation names to the standardize_address() function to cause memory corruption by providing a malicious rules table entry with an oversized classification Type value. This value is used without proper bounds checking, leading to an out-of-bounds write in an internal output-link table.