Threats affecting pkg:github/dalibo/postgresql_anonymizer

A vulnerability in PostgreSQL Anonymizer allows data-modifying Common Table Expressions (CTEs) to bypass the read-only restrictions imposed on masked roles. This issue is addressed in PostgreSQL Anonymizer version 3.3.0 and later.

PostgreSQL Anonymizer versions prior to 3.3.0 have a vulnerability where statistics about original data remain visible in the pg_stats system catalog until an ANALYZE operation is performed. This exposure can reveal sensitive information despite data masking. The issue is resolved in version 3.3.0 and later.

PostgreSQL Anonymizer versions prior to 3.3.0 contain a vulnerability in the anon.partial() and anon.partial_email() functions that can reveal the entire data if the data size is small enough. This issue is addressed in version 3.3.0 and later.

CVE-2026-110181 is a vulnerability in DALIBO PostgreSQL Anonymizer affecting versions prior to 3.3.0. The flaw involves anonymization functions defined using SQL-standard function bodies, where PostgreSQL analyzes these functions at declaration time but the Anonymizer only checks them at execution time. This discrepancy allows exploitation by any user with the TEMPORARY privilege. The issue is fixed in version 3.3.0 and later.

CVE-2026-105620 is a vulnerability in DALIBO PostgreSQL Anonymizer where data returned by a sub-query in a rule is not properly masked. This issue allows unauthorized access to sensitive data. The vulnerability is fixed in version 3.3.0 and later.

CVE-2026-105619 is a vulnerability in DALIBO PostgreSQL Anonymizer versions prior to 3.3.0 where data accessed through a security_invoker view is not properly masked. This missing authorization issue allows unauthorized access to sensitive data. The vulnerability has a CVSS score of 4.8, indicating medium severity. The issue is fixed in version 3.3.0 and later.

CVE-2026-105618 is a missing authorization vulnerability in DALIBO PostgreSQL Anonymizer versions prior to 3.3.0. The issue arises because direct access to partition and inheritance tables is masked only through the parent table, allowing unauthorized access to these tables. This vulnerability is resolved in version 3.3.0 and later.

CVE-2026-105617 is a vulnerability in DALIBO PostgreSQL Anonymizer versions prior to 3.3.0 where prepared plans are not invalidated after a rule addition or role change. This allows users to access unmasked sensitive data until the session ends. The issue is fixed in version 3.3.0.

CVE-2026-105616 is a vulnerability in DALIBO PostgreSQL Anonymizer versions prior to 3.3.0 where sensitive information (salt and shift values) can be exposed to unauthorized users. Although PostgreSQL restricts access to these values via the SHOW command for non-privileged users, they remain visible in system catalogs such as pg_db_role_setting or pg_roles if set at the database or user level. This exposure could allow unauthorized actors with limited privileges to obtain sensitive anonymization parameters. The issue is fixed in PostgreSQL Anonymizer version 3.3.0 and later.

CVE-2026-105615 is a vulnerability in DALIBO PostgreSQL Anonymizer versions prior to 3.3.0 where optimized statistics on a table are accessible to users with SELECT privileges. This allows a masked role to infer limited sensitive information through statistical views such as histograms and most common values (MCVs). The issue is resolved in version 3.3.0 and later.

CVE-2026-105614 is a medium severity vulnerability in DALIBO PostgreSQL Anonymizer versions 1.0.0 up to but not including 3.3.0. The flaw exists in the anon.image_blur() function, which fails to validate the declared dimensions of an input image. An attacker can exploit this by submitting a small image with falsely large declared dimensions, causing excessive memory allocation. This can lead to backend memory exhaustion and out-of-memory (OOM) termination, triggering a cluster-wide crash recovery. The issue is fixed in version 3.3.0 and later.

CVE-2026-105613 is a vulnerability in DALIBO's PostgreSQL Anonymizer where range-based dummy functions do not limit the size of the range. This flaw allows an attacker to cause excessive memory allocation, potentially exhausting backend memory and triggering an out-of-memory kill if overcommit is enabled. The resulting crash leads to cluster-wide recovery. The issue is fixed in version 3.3.0 of PostgreSQL Anonymizer.