CVE-2025-8713: PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table

Severity: low (CVSS 3.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-14 · updated 2026-06-17
Weakness: CWE-1230

Description

PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.

Affected products

PostgreSQL: from 17 before 17.6; from 16 before 16.10; from 15 before 15.14; from 14 before 14.19; before 13.22 — fixed in 13.22, 14.19, 15.14, 16.10, 17.6

How to fix

Upgrade to a fixed version: PostgreSQL 13.22, 14.19, 15.14, 16.10. Check the vendor advisory for mitigations.

References

https://www.postgresql.org/support/security/CVE-2025-8713/

Get alerted when CVE-2025-8713 or the next vulnerability affects your stack