CVE-2026-90775 PostGIS CVE debrief

Who should care

Defenders responsible for PostGIS address_standardizer installations, PostgreSQL administrators, and security teams should assess exposure and prioritize verification and remediation.

Why it matters

Defenders should prioritize verifying and updating PostGIS address_standardizer to a secure version, reviewing and restricting access to caller-supplied rules tables, and monitoring PostgreSQL backend process crashes, as the vulnerability can cause the PostgreSQL backend process to crash and terminate all cluster sessions.

• Potential PostgreSQL backend process crashes and cluster session terminations
• Need to verify and update PostGIS address_standardizer to a secure version
• Requirement to review and restrict access to caller-supplied rules tables

Technical summary

The PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index, causing the PostgreSQL backend process to crash and terminate all cluster sessions. This vulnerability is caused by inadequate input validation, allowing attackers to craft malicious rule rows with out-of-range Weight values. The vulnerability can be mitigated by verifying and updating PostGIS address_standardizer to a secure version, reviewing and restricting access to caller-supplied rules tables, and monitoring PostgreSQL backend process crashes.

Defensive priority

Defenders should prioritize verifying and updating PostGIS address_standardizer to a secure version, reviewing and restricting access to caller-supplied rules tables, and monitoring PostgreSQL backend process crashes.

Recommended defensive actions

• Verify and update PostGIS address_standardizer to a secure version
• Review and restrict access to caller-supplied rules tables
• Monitor PostgreSQL backend process crashes and cluster session terminations
• Perform a thorough review of the system to identify potential vulnerabilities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Review relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and references. The vulnerability is caused by the lack of input validation in the Weight parameter, which allows attackers to trigger out-of-bounds reads in the load_value array. Defenders should verify the vulnerability's impact on their systems, review and restrict access to caller-supplied rules tables, and monitor PostgreSQL backend process crashes. The CVE record and NVD vulnerability detail page are

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.