CVE-2026-73515

NameCVE-2026-73515
DescriptionPostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
postgis (PTS)bullseye3.1.1+dfsg-1+deb11u2vulnerable
bookworm3.3.2+dfsg-1vulnerable
trixie3.5.2+dfsg-1vulnerable
forky, sid3.6.4+dfsg-2vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
postgissource(unstable)(unfixed)

Notes

check upstream details

Search for package or bug name: Reporting problems