CVE-2025-12817: PostgreSQL CREATE STATISTICS DOS Vulnerability

CVE-2025-12817 Overview

CVE-2025-12817 is a missing authorization flaw [CWE-862] in the PostgreSQL CREATE STATISTICS command. A table owner can create a statistics object in any schema, bypassing the schema-level CREATE privilege check. A subsequent CREATE STATISTICS call for the same name, issued by a legitimate user with the CREATE privilege, fails because the name is already taken. This produces a denial-of-service condition against other users of CREATE STATISTICS. The issue affects PostgreSQL versions prior to 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23.

Critical Impact
An authenticated table owner can squat on statistics object names in arbitrary schemas, blocking legitimate CREATE STATISTICS operations by other privileged users.

Affected Products

PostgreSQL versions before 18.1
PostgreSQL versions before 17.7, 16.11, and 15.15
PostgreSQL versions before 14.20 and 13.23

Discovery Timeline

2025-11-13 - CVE-2025-12817 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12817

Vulnerability Analysis

The vulnerability resides in how PostgreSQL processes the CREATE STATISTICS statement. PostgreSQL supports extended statistics objects to help the query planner estimate correlations across columns. Creating such an object should require the CREATE privilege on the target schema. The CREATE STATISTICS code path fails to enforce that authorization check when the invoker owns the underlying table. As a result, a table owner can create a statistics object in any schema, including schemas they do not otherwise have write access to.

Because statistics object names are unique within their schema, a malicious or careless table owner can place an object under a name another user intends to use. The later, properly authorized CREATE STATISTICS call fails with a duplicate-object error. This blocks legitimate query-optimization workflows and can degrade planner behavior for other tenants.

Root Cause

The root cause is a missing authorization check [CWE-862] in the CREATE STATISTICS command handler. The code validates ownership of the referenced table but omits verification of CREATE privilege on the destination schema. This design gap violates the principle that object creation in a schema must be gated by that schema's CREATE privilege.

Attack Vector

Exploitation requires an authenticated database session and ownership of at least one table. The attacker issues CREATE STATISTICS statements that target schemas owned by other principals, using names likely to be requested by legitimate users. No network-level exploitation primitive is required beyond normal PostgreSQL client access. Confidentiality and integrity are not affected; the impact is limited to availability of the CREATE STATISTICS feature for other users. See the PostgreSQL Security Advisory CVE-2025-12817 for authoritative technical details.

Detection Methods for CVE-2025-12817

Indicators of Compromise

Failed CREATE STATISTICS statements from privileged users reporting a duplicate object name in a schema where they hold the CREATE privilege.
Presence of statistics objects in pg_statistic_ext owned by users who lack CREATE privilege on the containing schema.
Unexpected statistics objects created by table owners across multiple schemas within a short time window.

Detection Strategies

Audit the pg_statistic_ext catalog and cross-reference each object's stxowner against the schema owner and schema ACL to find objects that could not have been created under normal authorization rules.
Enable log_statement = 'ddl' in postgresql.conf to capture all CREATE STATISTICS invocations, then review logs for cross-schema activity by non-privileged roles.
Alert on repeated ERROR: statistics object "..." already exists messages, which indicate name squatting attempts.

Monitoring Recommendations

Forward PostgreSQL server logs to a centralized logging pipeline and build queries that correlate CREATE STATISTICS DDL with the invoking role and target schema.
Track the count and ownership distribution of extended statistics objects over time as a baseline metric.
Review database role privileges quarterly to minimize the number of users capable of creating tables in shared schemas.

How to Mitigate CVE-2025-12817

Immediate Actions Required

Upgrade PostgreSQL to 18.1, 17.7, 16.11, 15.15, 14.20, 13.23, or later, matching the major version deployed in your environment.
Inventory extended statistics objects and remove any that were created outside the intended authorization model.
Restrict table ownership in shared or multi-tenant schemas to trusted roles only.

Patch Information

The PostgreSQL Global Development Group fixed the missing authorization check in the minor releases listed in the PostgreSQL Security Advisory CVE-2025-12817. Apply the fixed minor version for your major branch: 18.1, 17.7, 16.11, 15.15, 14.20, or 13.23. No configuration change is required after the upgrade; the CREATE STATISTICS command will enforce schema CREATE privilege after patching.

Workarounds

Revoke CREATE on shared schemas from roles that own tables but should not create statistics objects there, using REVOKE CREATE ON SCHEMA <name> FROM <role>.
Separate tenants into dedicated schemas so that a table owner in one schema cannot affect statistics naming in another.
Monitor pg_statistic_ext regularly and drop unauthorized objects with DROP STATISTICS to unblock legitimate users until patches are applied.

bash

# Configuration example: enable DDL logging to detect abuse
# Add to postgresql.conf, then reload the server
log_statement = 'ddl'
log_line_prefix = '%m [%p] user=%u,db=%d,app=%a '
# Reload configuration
pg_ctl reload -D /var/lib/postgresql/data