CVE-2026-90775: PostGIS address_standardizer DoS Vulnerability

CVE-2026-90775 Overview

CVE-2026-90775 is an out-of-bounds read vulnerability [CWE-125] in the PostGIS address_standardizer extension through version 3.7.0. The flaw resides in the extension's handling of the Weight parameter from caller-supplied rules tables. The extension fails to validate Weight before using it as an index into the load_value array. An authenticated attacker who can insert rule rows can supply out-of-range Weight values to trigger reads outside the array bounds. The out-of-bounds access crashes the PostgreSQL backend process and terminates all active cluster sessions, producing a denial-of-service condition against the database.

Critical Impact

A low-privileged database user with the ability to write rule rows can crash the PostgreSQL backend and terminate every session in the cluster.

Affected Products

• PostGIS address_standardizer extension versions up to and including 3.7.0
• PostGIS address_standardizer_data_us dataset extension up to and including 3.7.0
• PostgreSQL deployments loading the vulnerable extension

Discovery Timeline

• 2026-09-13 - CVE-2026-90775 published to NVD
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90775

Vulnerability Analysis

The address_standardizer extension parses postal addresses into components using rule tables supplied by the caller. Each rule row contains a Weight field that the extension uses to index into the internal load_value array. The vulnerable code paths in src/analyze.c and src/gamma.c do not enforce bounds checking on Weight before dereferencing the array. When a rule row contains a Weight value outside the valid index range, the extension reads memory beyond the allocated array, which corrupts internal state and crashes the PostgreSQL backend process. Because PostgreSQL isolates each session in a backend process but shares state at the postmaster level, a backend crash triggers a cluster-wide restart that terminates all connected sessions.

Root Cause

The root cause is missing input validation on data sourced from a rules table. The extension trusts the Weight value from caller-supplied rows and uses it directly as an array subscript. There is no upper- or lower-bound check before the load_value[Weight] access, so any value outside the array size range dereferences invalid memory.

Attack Vector

Exploitation requires network access to PostgreSQL and low privileges sufficient to insert rows into a rules table consumed by address_standardizer. No user interaction is needed. Once the attacker submits a query that invokes standardization with the malicious rule, the backend performs the out-of-bounds read and crashes. Availability of the entire cluster is affected.

# Security patch: address_standardizer.control
 # address_standardizer extension
 comment = 'Parse addresses into constituent elements (street name, number, etc)'
-default_version = '3.7'
+default_version = '3.7.1dev'
 relocatable = true
 module_pathname = '$libdir/address_standardizer'

Source: GitHub commit a5cb4b1. The upstream fix adds bounds validation on rule weights and bumps the extension version to 3.7.1dev. A parallel patch updates address_standardizer_data_us.control in commit e987949.

Detection Methods for CVE-2026-90775

Indicators of Compromise

• Sudden PostgreSQL backend termination messages such as server closed the connection unexpectedly across multiple sessions
• PostgreSQL log entries indicating a backend crash and automatic postmaster recovery immediately after standardize_address calls
• Insertions or updates to address_standardizer rules tables containing Weight values outside the documented range

Detection Strategies

• Audit SQL statements that write to rules tables consumed by address_standardizer and flag rows with anomalous Weight values
• Correlate PostgreSQL backend crash events with prior calls to standardize_address or related functions to identify triggering sessions
• Inventory PostgreSQL clusters running PostGIS to confirm which instances load address_standardizer at or below version 3.7.0

Monitoring Recommendations

• Forward PostgreSQL server logs to a central logging platform and alert on repeated backend termination or postmaster restart events
• Monitor for privilege grants that allow non-administrative roles to write to address_standardizer rules tables
• Track PostGIS extension versions across the database fleet and alert when vulnerable versions are detected

How to Mitigate CVE-2026-90775

Immediate Actions Required

• Upgrade the address_standardizer extension to a version that includes the Weight bounds validation fix from PostGIS pull request 6
• Revoke write access on rules tables from roles that do not require it, limiting who can insert or update rule rows
• Restart affected PostgreSQL clusters after upgrading to ensure the patched extension is loaded

Patch Information

The upstream fix is merged in pull request #6 and applied in commits a5cb4b1 and e987949. The patched extension is versioned 3.7.1dev. Rebuild PostGIS from source at or above these commits, or install a distribution package that includes the fix. See the VulnCheck advisory for additional context.

Workarounds

• Restrict INSERT and UPDATE privileges on address_standardizer rules tables to trusted administrators only
• Validate Weight values at the application layer before writing rule rows to the database
• Disable or unload the address_standardizer extension on clusters that do not use address standardization until patching is complete

# Restrict write access on the rules table to trusted roles
REVOKE INSERT, UPDATE, DELETE ON TABLE public.rules FROM PUBLIC;
GRANT SELECT ON TABLE public.rules TO app_reader;
GRANT INSERT, UPDATE, DELETE ON TABLE public.rules TO dba_admin;

# Verify installed extension version
SELECT extname, extversion FROM pg_extension WHERE extname = 'address_standardizer';