{"id":"CVE-2026-120065","aliases":["DEBIAN-CVE-2026-120065","EUVD-2026-115378","GHSA-9cg8-r57h-h6jj","GHSA-gv3c-v55x-3f23","UBUNTU-CVE-2026-120065","openSUSE-SU-2026:12472-1","openSUSE-SU-2026:22261-1"],"status":"published","title":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00294,"percentile":0.22211,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2026-11-02T19:09:14Z","modified":"2026-11-11T17:27:07Z","fixes":[{"ecosystem":"Debian:14","package":"psqlodbc","fixed_in":["1:18.00.0006-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.02.0000-2","1:15.00.0000-1","1:16.00.0000-1","1:16.00.0005-1","1:17.00.0004-1","1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:13","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1","1:18.00.0006-1"]},{"source":"osv","ecosystem":"Debian:14","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.00.0006-1"}]}],"versions":["1:17.00.0004-2","1:17.00.0005-1","1:17.00.0006-1","1:17.00.0006-2","1:17.00.0007-1","1:17.00.0008-1","1:18.00.0001-1","1:18.00.0002-1","1:18.00.0003-1","1:18.00.0003-2","1:18.00.0004-1","1:18.00.0005-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.03.0300-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:09.06.0410-1","1:10.00.0000-1","1:10.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:11.00.0000-1","1:12.00.0000-1","1:12.01.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:13.00.0000-1","1:13.02.0000-1","1:13.02.0000-2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:15.00.0000-1","1:16.00.0000-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0007-1","1:18.00.0001-1","1:18.00.0002-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"psqlodbc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:17.00.0006-2","1:17.00.0007-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-1.1"}]}],"bundled":11},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"psqlODBC","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.00.0006-bp160.1.1"}]}],"bundled":11}],"products":[{"vendor":"postgresql","product":"psqlodbc"}],"references":[{"url":"https://github.com/postgresql-interfaces/psqlodbc/security/advisories/GHSA-9cg8-r57h-h6jj","tags":["vendor-advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120065","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gv3c-v55x-3f23"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120065.json","tags":["advisory"]},{"url":"https://github.com/postgresql-interfaces/psqlodbc","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-120065","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-120065","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120065","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120058","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120060","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120061","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120063","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120064","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120065","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-120067","tags":["web"]},{"url":"https://bugzilla.suse.com/1289252","tags":["report"]},{"url":"https://bugzilla.suse.com/1289253","tags":["report"]},{"url":"https://bugzilla.suse.com/1289254","tags":["report"]},{"url":"https://bugzilla.suse.com/1289255","tags":["report"]},{"url":"https://bugzilla.suse.com/1289256","tags":["report"]},{"url":"https://bugzilla.suse.com/1289257","tags":["report"]},{"url":"https://bugzilla.suse.com/1289258","tags":["report"]},{"url":"https://bugzilla.suse.com/1289259","tags":["report"]},{"url":"https://bugzilla.suse.com/1289260","tags":["report"]},{"url":"https://bugzilla.suse.com/1289261","tags":["report"]},{"url":"https://bugzilla.suse.com/1289262","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-120065","title":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:14.045Z","modified":"2026-11-02T19:36:42.876Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T20:51:24.336573Z"}],"euvd":[{"id":"EUVD-2026-115378","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:14Z","modified":"2026-11-02T19:36:42Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T05:08:38.228652Z"}],"ghsa":[{"id":"GHSA-gv3c-v55x-3f23","title":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column,...","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T21:31:57Z","modified":"2026-11-02T21:31:57Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-03T00:02:47.574481Z"}],"nvd":[{"id":"CVE-2026-120065","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.85Z","modified":"2026-11-02T20:17:39.8Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-03T00:02:42.67885Z"}],"osv":[{"id":"CVE-2026-120065","title":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:09:14.045Z","modified":"2026-11-11T17:27:07.6576149Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-08T02:57:14.556074Z"},{"id":"DEBIAN-CVE-2026-120065","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:03.85Z","modified":"2026-11-05T10:00:22.53682234Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"UBUNTU-CVE-2026-120065","description":"For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and DELETE statements, without doubling any double quote in the name. A column name that contains a double quote therefore changes the SQL that the driver runs with the application's privileges, including which rows a positioned UPDATE or DELETE affects. Any database user who can create a table that the application reads with an updatable cursor can choose such a name, and so can a server not trusted under current SSL settings. Versions before psqlODBC 18.00.0006 are affected.","status":"published","published":"2026-11-02T19:18:00Z","modified":"2026-11-05T04:42:52Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:33:25.727744Z"},{"id":"openSUSE-SU-2026:12472-1","title":"psqlODBC-18.00.0006-1.1 on GA media","description":"These are all security issues fixed in the psqlODBC-18.00.0006-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-06T00:00:00Z","modified":"2026-11-07T17:23:16.02618632Z","updated_at":"2026-11-07T17:50:39.727056Z"},{"id":"openSUSE-SU-2026:22261-1","title":"Security update for psqlODBC","description":"This update for psqlODBC fixes the following issues:\n\nChanges in psqlODBC:\n\n- Update to 18.00.0006:\n  * Large-object read overflows the application buffer\n    (CVE-2026-120057, bsc#1289252).\n  * Row cache overflow when a later FETCH changes the column count\n    (CVE-2026-120058, bsc#1289253).\n  * Driver uses a server-supplied column name as a format string\n    (CVE-2026-120059, bsc#1289254).\n  * Driver does not validate server-supplied counts and lengths\n    (CVE-2026-120060, bsc#1289255).\n  * ODBC escape parser stack buffer overflow\n    (CVE-2026-120061, bsc#1289256).\n  * SQL injection through SQLSpecialColumns table and schema names\n    (CVE-2026-120062, bsc#1289257).\n  * Stack buffer overflow when quoting long schema and table names\n    (CVE-2026-120063, bsc#1289258).\n  * Driver does not validate column numbers and row indexes in\n    binding and descriptor functions\n    (CVE-2026-120064, bsc#1289259).\n  * Driver does not escape a server-supplied column name in its\n    updatable-cursor queries (CVE-2026-120065, bsc#1289260).\n  * Log files are created with default permissions at a predictable\n    path and follow symbolic links\n    (CVE-2026-120066, bsc#1289261).\n  * Stack buffer overflow when reading the keyset (ctid/oid)\n    columns of an updatable cursor\n    (CVE-2026-120067, bsc#1289262).\n  * Hardening: SQLSetDescRecW stored a freed buffer and the address\n    of a local variable as deferred bound data. It now stores the\n    application's pointers, as SQLSetDescRec does.\n  * Hardening: SQLColumns returned uninitialized relkind and table\n    OID values when the table query returned no rows.\n  * Hardening: convert_linefeeds could dereference a NULL pointer\n    in one build configuration.\n  * Hardening: secure_sscanf limits an over-wide %Ns width,\n    msgtowstr checks for a zero buffer length, and the MSDTC\n    connect-string append is bounded.\n","status":"published","published":"2026-11-06T16:51:52Z","modified":"2026-11-11T17:23:13.168183448Z","updated_at":"2026-11-11T17:47:15.466074Z"}]}}