CVE-2026-90775: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-90775 is an out-of-bounds read vulnerability in PostGIS address_standardizer through version 3.7.0 that allows authenticated attackers to crash the PostgreSQL backend process and terminate all cluster sessions. The flaw stems from the failure to validate the Weight parameter from caller-supplied rules tables before using it as an index into the load_value array. It was published on September 13, 2026, with a patch merged on August 14, 2026. The vulnerability carries a CVSS v3.1 score of 6.5 (Medium) and a CVSS v4.0 score of 7.1 (High) (GitHub Advisory, EUVD).

The root cause is CWE-125 (Out-of-bounds Read): the rules_add_rule() function in src/gamma.c reads the Weight integer from a caller-supplied rule row and passes it directly to classify_link(), which stores it in a KW struct. That stored weight is later used as a direct index into the statically-sized load_value[] array (18 elements, indices 0–17) without any bounds check. An attacker who can insert or modify rows in the rules table can supply a negative value or a value ≥ NUMBER_OF_WEIGHTS, causing an out-of-bounds memory read when the weight is subsequently dereferenced as an array index, which crashes the PostgreSQL backend process (gamma.c source, analyze.c source). The fix, merged in PR #6, adds a guard in rules_add_rule() that rejects any weight outside [0, NUMBER_OF_WEIGHTS) before classification proceeds (Fix commit).

Successful exploitation causes the PostgreSQL backend process to crash, immediately terminating all active sessions on the cluster — a complete denial-of-service against database availability. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. Because a single backend crash can affect all cluster sessions, the blast radius extends to every application and user connected to the affected PostgreSQL instance at the time of exploitation (GitHub Advisory, EUVD).

Exploitation requires low-privilege authenticated access to the PostgreSQL database with the ability to supply or modify rules tables used by address_standardizer. No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (EUVD, GitHub Advisory).

1. Reconnaissance: Identify PostgreSQL instances with the address_standardizer extension installed and version ≤ 3.7.0 by querying SELECT * FROM pg_extension WHERE extname = 'address_standardizer'; after obtaining low-privilege database credentials.
2. Gain write access to rules table: Using a database account with INSERT or UPDATE privileges on the rules table consumed by address_standardizer, prepare a malicious rule row.
3. Craft malicious Weight value: Construct a rule entry where the Weight field is set to an out-of-range value — either a negative integer (e.g., -1) or a value ≥ NUMBER_OF_WEIGHTS (e.g., 18 or higher) — which will bypass the absent bounds check in the vulnerable rules_add_rule() function.
4. Trigger rule loading: Invoke an address_standardizer function (e.g., standardize_address()) that causes the malicious rule to be loaded and the weight to be used as an index into the load_value[] array.
5. Achieve denial of service: The out-of-bounds read triggers a crash of the PostgreSQL backend process, terminating all active cluster sessions (gamma.c source, Fix commit).

• Logs: PostgreSQL server logs showing unexpected backend process termination with signals (e.g., SIGSEGV or SIGABRT) originating from the address_standardizer shared library; log entries referencing rules_add_rule or classify_link at crash time.
• Logs: PostgreSQL logs recording abrupt disconnection of all sessions simultaneously, particularly following a call to standardize_address() or related functions.
• Database: Unexpected or anomalous rows in rules tables used by address_standardizer containing Weight values outside the valid range of 0–17 (i.e., negative values or values ≥ 18).
• Process: Repeated PostgreSQL backend process restarts (postmaster respawning) without a clear administrative cause, especially correlated with address_standardizer function invocations.

Upgrade address_standardizer to version 3.7.1 or later, which includes the fix that rejects out-of-range Weight values in rules_add_rule() before they can be used as array indexes. The patch was merged on August 14, 2026 (commit a5cb4b1) and is documented in the 3.7.1dev release notes. As an interim workaround, restrict INSERT and UPDATE privileges on rules tables to trusted database users only, and audit existing rules tables for Weight values outside the range 0–17 (Fix commit, NEWS.md, PR #6).

The vulnerability was reported by Harsh Raj Singhania and fixed by Darafei Praliaskouski (Komzpa), as credited in the project's NEWS.md. The fix was reviewed and merged with automated checks by CodeRabbit, which characterized the change as minimal-risk and straightforward. No significant broader media coverage or notable community commentary beyond the GitHub pull request discussion has been identified (PR #6, NEWS.md).