CVE-2026-105614

The record

PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image, allowing an attacker to provide a small image with enormous declared dimensions. This vulnerability can be exploited to exhaust the memory of a backend and OOM-kill it (when ovecommit is on), which results in a cluster-wide crash recovery. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

Affected packages

Related vulnerabilities

• CVE-2026-62297 ag-psd is a JavaScript library for reading and writing Photoshop Document files. CWE-789
• CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-789
• CVE-2026-61845 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-789
• CVE-2026-115865 Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to… CWE-789
• CVE-2026-119280 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-119278 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-119276 MariaDB Connector/J is used to connect applications developed in Java to MariaDB and… CWE-789
• CVE-2026-118590 A security vulnerability has been detected in nipy nibabel up to 5.4.2. CWE-789