Find a vulnerability

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-118391",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-04T20:48:32.374051Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-05T19:07:34.294Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ecto",
          "packageURL": "pkg:hex/ecto",
          "product": "ecto",
          "repo": "https://github.com/elixir-ecto/ecto",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "3.14.3",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "elixir-ecto/ecto",
          "packageURL": "pkg:github/elixir-ecto/ecto",
          "product": "ecto",
          "repo": "https://github.com/elixir-ecto/ecto",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "eef014ad090d27d1a5b69c0e32a50eabd44ab3bb",
              "status": "affected",
              "version": "cb2f03964dac324a9771f84f5088e395326e6de8",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must pass request data into an interpolated JSON path (\u003ccode\u003ejson_extract_path(field, ^path)\u003c/code\u003e, \u003ccode\u003ejson_extract_path(field, [^key])\u003c/code\u003e or \u003ccode\u003efield[^key]\u003c/code\u003e), or a request-controlled list into \u003ccode\u003esplice/1\u003c/code\u003e, and run the query through a repository with the default \u003ccode\u003equery_cache: true\u003c/code\u003e.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must pass request data into an interpolated JSON path (`json_extract_path(field, ^path)`, `json_extract_path(field, [^key])` or `field[^key]`), or a request-controlled list into `splice/1`, and run the query through a repository with the default `query_cache: true`."
            }
          ],
          "value": "The application must pass request data into an interpolated JSON path (json_extract_path(field, ^path), json_extract_path(field, [^key]) or field[^key]), or a request-controlled list into splice/1, and run the query through a repository with the default query_cache: true."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-ecto:ecto:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "3.14.3",
                  "versionStartIncluding": "3.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Eric Meadows-J\u00f6nsson"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim"
        }
      ],
      "dateAssigned": "2026-10-30T12:36:37.000Z",
      "datePublic": "2026-11-04T08:46:53.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAllocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into \u003ccode\u003ejson_extract_path/2\u003c/code\u003e, \u003ccode\u003efield[^key]\u003c/code\u003e or \u003ccode\u003esplice/1\u003c/code\u003e. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and \u003ccode\u003esplice/1\u003c/code\u003e expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart.\u003c/p\u003e\n\u003cp\u003eThis issue affects ecto: from 3.4.0 before 3.14.3.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into `json_extract_path/2`, `field[^key]` or `splice/1`. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and `splice/1` expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart.\n\nThis issue affects ecto: from 3.4.0 before 3.14.3."
            }
          ],
          "value": "Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys or list lengths where the application interpolates them into json_extract_path/2, field[^key] or splice/1. Ecto caches prepared queries per repository in an ETS table with no size limit and no eviction. Interpolated JSON path elements become part of the query expression instead of its parameters, and splice/1 expands into one placeholder per element, so every distinct key or list length creates a new cache entry. With ecto_sql each entry is also a new prepared statement on the database connection that runs it. None of this memory is released until the processes restart.\n\nThis issue affects ecto: from 3.4.0 before 3.14.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-131",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eAn unauthenticated client can make the application and its database keep memory from every request that carries a new JSON key or list length, when the application passes it into an interpolated JSON path or \u003ccode\u003esplice/1\u003c/code\u003e. Nothing frees that memory until the processes restart. In the proof of concept, 200 requests with 100 MB of keys in total left 191 MB in the BEAM and 289 MB in the PostgreSQL backend of one connection. Sustained requests exhaust memory in the application node, the database server, or both.\u003c/p\u003e"
                },
                {
                  "base64": false,
                  "type": "text/markdown",
                  "value": "An unauthenticated client can make the application and its database keep memory from every request that carries a new JSON key or list length, when the application passes it into an interpolated JSON path or `splice/1`. Nothing frees that memory until the processes restart. In the proof of concept, 200 requests with 100 MB of keys in total left 191 MB in the BEAM and 289 MB in the PostgreSQL backend of one connection. Sustained requests exhaust memory in the application node, the database server, or both."
                }
              ],
              "value": "An unauthenticated client can make the application and its database keep memory from every request that carries a new JSON key or list length, when the application passes it into an interpolated JSON path or splice/1. Nothing frees that memory until the processes restart. In the proof of concept, 200 requests with 100 MB of keys in total left 191 MB in the BEAM and 289 MB in the PostgreSQL backend of one connection. Sustained requests exhaust memory in the application node, the database server, or both."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.9,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-04T13:57:29.762Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "name": "GHSA-cxjx-vmm2-qr8r",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-cxjx-vmm2-qr8r"
        },
        {
          "name": "EEF CNA record for CVE-2026-118391",
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-118391.html"
        },
        {
          "name": "OSV record EEF-CVE-2026-118391",
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-118391"
        },
        {
          "name": "Do not cache queries with interpolated JSON paths, splices, and constants (main)",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/ecto/commit/d0e97d8a6e274c81c25fbf08087da8d8b9bae0ea"
        },
        {
          "name": "Ecto.Query.API.json_extract_path/2",
          "tags": [
            "technical-description"
          ],
          "url": "https://ecto.hexdocs.pm/Ecto.Query.API.html#json_extract_path/2"
        },
        {
          "name": "Ecto.Query.API.splice/1",
          "tags": [
            "technical-description"
          ],
          "url": "https://ecto.hexdocs.pm/Ecto.Query.API.html#splice/1"
        },
        {
          "name": "Add splice to fragment (#4228), v3.11.0",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/commit/eb03f45b999e2bf67ffae92811233eb6e56dba55"
        },
        {
          "name": "Should we allow disabling of Ecto cache on specific queries? (#4470)",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/issues/4470"
        },
        {
          "name": "String interpolation will grow cached unboundedly (#1031)",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/issues/1031"
        },
        {
          "name": "Introducing commit cb2f039 in elixir-ecto/ecto",
          "tags": [
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/commit/cb2f03964dac324a9771f84f5088e395326e6de8"
        },
        {
          "name": "Fix commit eef014a in elixir-ecto/ecto",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/ecto/commit/eef014ad090d27d1a5b69c0e32a50eabd44ab3bb"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade Ecto to 3.14.3 or later. Queries with interpolated JSON path elements or an interpolated \u003ccode\u003esplice/1\u003c/code\u003e list are no longer cached, the same as running them with \u003ccode\u003equery_cache: false\u003c/code\u003e, so distinct keys and list lengths don\u0027t add cache entries.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Upgrade Ecto to 3.14.3 or later. Queries with interpolated JSON path elements or an interpolated `splice/1` list are no longer cached, the same as running them with `query_cache: false`, so distinct keys and list lengths don\u0027t add cache entries."
            }
          ],
          "value": "Upgrade Ecto to 3.14.3 or later. Queries with interpolated JSON path elements or an interpolated splice/1 list are no longer cached, the same as running them with query_cache: false, so distinct keys and list lengths don\u0027t add cache entries."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003ePass the path as a query parameter so it is not part of the cache key. With PostgreSQL: \u003ccode\u003efragment(\"? #\u0026gt; ?\", i.meta, type(^path, {:array, :string}))\u003c/code\u003e. Alternatively, disable the cache for these queries with \u003ccode\u003eRepo.all(query, query_cache: false)\u003c/code\u003e, or restrict keys and list lengths to a known set before building the query.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Pass the path as a query parameter so it is not part of the cache key. With PostgreSQL: `fragment(\"? #\u003e ?\", i.meta, type(^path, {:array, :string}))`. Alternatively, disable the cache for these queries with `Repo.all(query, query_cache: false)`, or restrict keys and list lengths to a known set before building the query."
            }
          ],
          "value": "Pass the path as a query parameter so it is not part of the cache key. With PostgreSQL: fragment(\"? #\u003e ?\", i.meta, type(^path, {:array, :string})). Alternatively, disable the cache for these queries with Repo.all(query, query_cache: false), or restrict keys and list lengths to a known set before building the query."
        }
      ],
      "x_proofOfConcept": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReproduced on Ecto main (\u003ccode\u003ead8fda5\u003c/code\u003e) with ecto_sql 3.14.0, Postgrex 0.22.4 and PostgreSQL 18.4, on Elixir 1.20.4 and Erlang/OTP 29, with \u003ccode\u003epool_size: 1\u003c/code\u003e.\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eDefine a handler that filters by a JSON key from the request: \u003ccode\u003eRepo.all(from i in Item, where: json_extract_path(i.meta, ^[key]) == ^value, select: i.id)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eSend 2,000 requests with the same key. The query cache has 1 entry and the connection 1 prepared statement; PostgreSQL backend memory goes from 2 MB to 3 MB.\u003c/li\u003e\n\u003cli\u003eSend 2,000 more requests with distinct short keys. The cache has 2,001 entries and the connection 2,001 prepared statements; backend memory is 21 MB.\u003c/li\u003e\n\u003cli\u003eSend 200 requests with a distinct 500 KB key each (100 MB in total). BEAM binary memory grows by 191 MB and PostgreSQL backend memory by 289 MB, measured after garbage collecting every process.\u003c/li\u003e\n\u003cli\u003eRepeating a key that was already seen adds nothing. \u003ccode\u003efragment(\"? IN (?)\", i.id, splice(^ids))\u003c/code\u003e with list lengths 1 to 300 adds 300 cache entries, while \u003ccode\u003ei.id in ^ids\u003c/code\u003e with the same lengths adds 1.\u003c/li\u003e\n\u003c/ol\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reproduced on Ecto main (`ad8fda5`) with ecto_sql 3.14.0, Postgrex 0.22.4 and PostgreSQL 18.4, on Elixir 1.20.4 and Erlang/OTP 29, with `pool_size: 1`.\n\n1. Define a handler that filters by a JSON key from the request: `Repo.all(from i in Item, where: json_extract_path(i.meta, ^[key]) == ^value, select: i.id)`.\n2. Send 2,000 requests with the same key. The query cache has 1 entry and the connection 1 prepared statement; PostgreSQL backend memory goes from 2 MB to 3 MB.\n3. Send 2,000 more requests with distinct short keys. The cache has 2,001 entries and the connection 2,001 prepared statements; backend memory is 21 MB.\n4. Send 200 requests with a distinct 500 KB key each (100 MB in total). BEAM binary memory grows by 191 MB and PostgreSQL backend memory by 289 MB, measured after garbage collecting every process.\n5. Repeating a key that was already seen adds nothing. `fragment(\"? IN (?)\", i.id, splice(^ids))` with list lengths 1 to 300 adds 300 cache entries, while `i.id in ^ids` with the same lengths adds 1."
            }
          ],
          "value": "Reproduced on Ecto main (ad8fda5) with ecto_sql 3.14.0, Postgrex 0.22.4 and PostgreSQL 18.4, on Elixir 1.20.4 and Erlang/OTP 29, with pool_size: 1.\n\n* Define a handler that filters by a JSON key from the request: Repo.all(from i in Item, where: json_extract_path(i.meta, ^[key]) == ^value, select: i.id).\n* Send 2,000 requests with the same key. The query cache has 1 entry and the connection 1 prepared statement; PostgreSQL backend memory goes from 2 MB to 3 MB.\n* Send 2,000 more requests with distinct short keys. The cache has 2,001 entries and the connection 2,001 prepared statements; backend memory is 21 MB.\n* Send 200 requests with a distinct 500 KB key each (100 MB in total). BEAM binary memory grows by 191 MB and PostgreSQL backend memory by 289 MB, measured after garbage collecting every process.\n* Repeating a key that was already seen adds nothing. fragment(\"? IN (?)\", i.id, splice(^ids)) with list lengths 1 to 300 adds 300 cache entries, while i.id in ^ids with the same lengths adds 1."
        }
      ],
      "x_technicalAnalysis": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cstrong\u003e1. Cache keys\u003c/strong\u003e (\u003ccode\u003elib/ecto/query/builder.ex\u003c/code\u003e, \u003ccode\u003elib/ecto/query/planner.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eescape_json_path/2\u003c/code\u003e checks interpolated path elements with \u003ccode\u003ejson_path_element!/1\u003c/code\u003e, and a whole interpolated path with \u003ccode\u003ejson_path!/1\u003c/code\u003e, at runtime and places the resulting strings and integers in the \u003ccode\u003e{:json_extract_path, [], [field, path]}\u003c/code\u003e expression instead of in the query parameters. \u003ccode\u003eEcto.Query.Planner\u003c/code\u003e builds the cache key from the query expressions, so every distinct path is a distinct key. \u003ccode\u003esplice(^list)\u003c/code\u003e keeps the values as parameters but expands into one placeholder per element. \u003ccode\u003ecast_and_merge_params/5\u003c/code\u003e marks \u003ccode\u003e{:in, _}\u003c/code\u003e parameters as not cacheable but keeps \u003ccode\u003e{:splice, _}\u003c/code\u003e parameters cacheable, so every distinct list length is a distinct key, and the entry grows with the length.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e2. Cache storage\u003c/strong\u003e (\u003ccode\u003elib/ecto/query/planner.ex\u003c/code\u003e, \u003ccode\u003elib/ecto/repo/supervisor.ex\u003c/code\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ccode\u003eEcto.Query.Planner.query/6\u003c/code\u003e stores each new query with \u003ccode\u003e:ets.insert_new/2\u003c/code\u003e in the table that \u003ccode\u003eEcto.Repo.Supervisor\u003c/code\u003e creates with \u003ccode\u003enew_query_cache/1\u003c/code\u003e, and nothing removes entries. ecto_sql renders the path into the SQL text, for example \u003ccode\u003eWHERE ((i0.\"meta\"#\u0026gt;array[\u0027color\u0027]::text[]) = $1)\u003c/code\u003e, and Postgrex prepares a named statement for each new SQL text on the connection that runs it.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003e3. Effect\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eEach request with a new key or list length adds memory that is never released, in the BEAM, where the cache is shared by the whole repository, and with ecto_sql in the database server, where prepared statements are kept per connection. Large keys amplify this: every 1 MB of request data retained about 2 MB in the application and 3 MB in PostgreSQL. The query cache was disabled for \u003ccode\u003evalues/2\u003c/code\u003e sources after a similar report, but not for these two cases.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "**1. Cache keys** (`lib/ecto/query/builder.ex`, `lib/ecto/query/planner.ex`)\n\n`escape_json_path/2` checks interpolated path elements with `json_path_element!/1`, and a whole interpolated path with `json_path!/1`, at runtime and places the resulting strings and integers in the `{:json_extract_path, [], [field, path]}` expression instead of in the query parameters. `Ecto.Query.Planner` builds the cache key from the query expressions, so every distinct path is a distinct key. `splice(^list)` keeps the values as parameters but expands into one placeholder per element. `cast_and_merge_params/5` marks `{:in, _}` parameters as not cacheable but keeps `{:splice, _}` parameters cacheable, so every distinct list length is a distinct key, and the entry grows with the length.\n\n**2. Cache storage** (`lib/ecto/query/planner.ex`, `lib/ecto/repo/supervisor.ex`)\n\n`Ecto.Query.Planner.query/6` stores each new query with `:ets.insert_new/2` in the table that `Ecto.Repo.Supervisor` creates with `new_query_cache/1`, and nothing removes entries. ecto_sql renders the path into the SQL text, for example `WHERE ((i0.\"meta\"#\u003earray[\u0027color\u0027]::text[]) = $1)`, and Postgrex prepares a named statement for each new SQL text on the connection that runs it.\n\n**3. Effect**\n\nEach request with a new key or list length adds memory that is never released, in the BEAM, where the cache is shared by the whole repository, and with ecto_sql in the database server, where prepared statements are kept per connection. Large keys amplify this: every 1 MB of request data retained about 2 MB in the application and 3 MB in PostgreSQL. The query cache was disabled for `values/2` sources after a similar report, but not for these two cases."
            }
          ],
          "value": "1. Cache keys (lib/ecto/query/builder.ex, lib/ecto/query/planner.ex)\n\nescape_json_path/2 checks interpolated path elements with json_path_element!/1, and a whole interpolated path with json_path!/1, at runtime and places the resulting strings and integers in the {:json_extract_path, [], [field, path]} expression instead of in the query parameters. Ecto.Query.Planner builds the cache key from the query expressions, so every distinct path is a distinct key. splice(^list) keeps the values as parameters but expands into one placeholder per element. cast_and_merge_params/5 marks {:in, _} parameters as not cacheable but keeps {:splice, _} parameters cacheable, so every distinct list length is a distinct key, and the entry grows with the length.\n\n2. Cache storage (lib/ecto/query/planner.ex, lib/ecto/repo/supervisor.ex)\n\nEcto.Query.Planner.query/6 stores each new query with :ets.insert_new/2 in the table that Ecto.Repo.Supervisor creates with new_query_cache/1, and nothing removes entries. ecto_sql renders the path into the SQL text, for example WHERE ((i0.\"meta\"#\u003earray[\u0027color\u0027]::text[]) = $1), and Postgrex prepares a named statement for each new SQL text on the connection that runs it.\n\n3. Effect\n\nEach request with a new key or list length adds memory that is never released, in the BEAM, where the cache is shared by the whole repository, and with ecto_sql in the database server, where prepared statements are kept per connection. Large keys amplify this: every 1 MB of request data retained about 2 MB in the application and 3 MB in PostgreSQL. The query cache was disabled for values/2 sources after a similar report, but not for these two cases."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-118391",
    "datePublished": "2026-11-04T13:57:29.762Z",
    "dateReserved": "2026-10-30T09:45:01.832Z",
    "dateUpdated": "2026-11-05T19:07:34.294Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-66838",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T15:11:28.060095Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T15:12:12.308Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex\u0027",
            "\u0027Elixir.Postgrex.Protocol\u0027"
          ],
          "packageName": "postgrex",
          "packageURL": "pkg:hex/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex.ex",
            "lib/postgrex/protocol.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex\u0027:stream/4"
            },
            {
              "name": "\u0027Elixir.Postgrex.Protocol\u0027:parse_describe_comment_msgs/3"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "0.22.4",
              "status": "affected",
              "version": "0.19.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex\u0027",
            "\u0027Elixir.Postgrex.Protocol\u0027"
          ],
          "packageName": "elixir-ecto/postgrex",
          "packageURL": "pkg:github/elixir-ecto/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex.ex",
            "lib/postgrex/protocol.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex\u0027:stream/4"
            },
            {
              "name": "\u0027Elixir.Postgrex.Protocol\u0027:parse_describe_comment_msgs/3"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "changes": [
                {
                  "at": "e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c",
                  "status": "unaffected"
                },
                {
                  "at": "4011be852c99dc61ddb98cb01aa41e8775a0e3dd",
                  "status": "unaffected"
                }
              ],
              "lessThan": "*",
              "status": "affected",
              "version": "4971a2722fa72f8e1b54a2c403cad4c43916e36d",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must pass a \u003ccode\u003e:comment\u003c/code\u003e derived from untrusted input to \u003ccode\u003ePostgrex.stream/4\u003c/code\u003e or \u003ccode\u003eEcto.Repo.stream/2\u003c/code\u003e. Applications that omit the option or pass only static values are unaffected.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "The application must pass a `:comment` derived from untrusted input to `Postgrex.stream/4` or `Ecto.Repo.stream/2`. Applications that omit the option or pass only static values are unaffected."
            }
          ],
          "value": "The application must pass a :comment derived from untrusted input to Postgrex.stream/4 or Ecto.Repo.stream/2. Applications that omit the option or pass only static values are unaffected."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.22.4",
                  "versionStartIncluding": "0.19.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Snehil Shah"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eImproper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex allows SQL Injection via the \u003ccode\u003e:comment\u003c/code\u003e option of \u003ccode\u003ePostgrex.stream/4\u003c/code\u003e. An attacker who can influence that value can close the comment delimiter with \u003ccode\u003e*/\u003c/code\u003e and extend the streamed statement with their own clauses, which execute under the connection\u0027s role. Ecto exposes the same option through \u003ccode\u003eEcto.Repo.stream/2\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003ePostgrex appends the comment by concatenating it into the statement text sent in the \u003ccode\u003eParse\u003c/code\u003e message, without escaping or rejecting \u003ccode\u003e*/\u003c/code\u003e. The option is validated by \u003ccode\u003ecomment_not_present!/1\u003c/code\u003e at every other execution point; \u003ccode\u003estream/4\u003c/code\u003e never calls it. Because \u003ccode\u003eParse\u003c/code\u003e accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.\u003c/p\u003e\n\u003cp\u003eThis issue affects postgrex: from 0.19.3 before 0.22.4.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex allows SQL Injection via the `:comment` option of `Postgrex.stream/4`. An attacker who can influence that value can close the comment delimiter with `*/` and extend the streamed statement with their own clauses, which execute under the connection\u0027s role. Ecto exposes the same option through `Ecto.Repo.stream/2`.\n\nPostgrex appends the comment by concatenating it into the statement text sent in the `Parse` message, without escaping or rejecting `*/`. The option is validated by `comment_not_present!/1` at every other execution point; `stream/4` never calls it. Because `Parse` accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.\n\nThis issue affects postgrex: from 0.19.3 before 0.22.4."
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex allows SQL Injection via the :comment option of Postgrex.stream/4. An attacker who can influence that value can close the comment delimiter with */ and extend the streamed statement with their own clauses, which execute under the connection\u0027s role. Ecto exposes the same option through Ecto.Repo.stream/2.\n\nPostgrex appends the comment by concatenating it into the statement text sent in the Parse message, without escaping or rejecting */. The option is validated by comment_not_present!/1 at every other execution point; stream/4 never calls it. Because Parse accepts a single command, the injection is confined to the streamed statement and further statements cannot be chained.\n\nThis issue affects postgrex: from 0.19.3 before 0.22.4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-07T12:20:02.376Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-3gww-3f36-2388"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-66838.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-66838"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/postgrex/commit/e1ecba618ddea4cee2556bd6ad9b6285e05f9d3c"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/postgrex/commit/4011be852c99dc61ddb98cb01aa41e8775a0e3dd"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SQL injection via the :comment option in Postgrex.stream/4",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eReject any \u003ccode\u003e:comment\u003c/code\u003e value containing \u003ccode\u003e*/\u003c/code\u003e or a null byte before passing it to \u003ccode\u003ePostgrex.stream/4\u003c/code\u003e or \u003ccode\u003eEcto.Repo.stream/2\u003c/code\u003e. Alternatively, build comments only from trusted values.\u003c/p\u003e"
            },
            {
              "base64": false,
              "type": "text/markdown",
              "value": "Reject any `:comment` value containing `*/` or a null byte before passing it to `Postgrex.stream/4` or `Ecto.Repo.stream/2`. Alternatively, build comments only from trusted values."
            }
          ],
          "value": "Reject any :comment value containing */ or a null byte before passing it to Postgrex.stream/4 or Ecto.Repo.stream/2. Alternatively, build comments only from trusted values."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-66838",
    "datePublished": "2026-08-07T12:20:02.376Z",
    "dateReserved": "2026-08-06T14:00:01.865Z",
    "dateUpdated": "2026-08-07T15:12:12.308Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-58225",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-10T11:47:10.671088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-10T11:47:16.925Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-4mw9-4qgj-m97w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "postgrex",
          "packageURL": "pkg:hex/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "0.22.3",
              "status": "affected",
              "version": "0.16.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "elixir-ecto/postgrex",
          "packageURL": "pkg:github/elixir-ecto/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "795c6062f62c4394272ff4b89170688857b4f841",
              "status": "affected",
              "version": "266b530faf9bde094e31e0e4ab851f933fadc0f5",
              "versionType": "git"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.22.3",
                  "versionStartIncluding": "0.16.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "AND"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Jos\u00e9 Valim"
        },
        {
          "lang": "en",
          "type": "analyst",
          "value": "Jonatan M\u00e4nnchen / EEF"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a \u003ctt\u003eLISTEN\u003c/tt\u003e channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection.\u003c/p\u003e\u003cp\u003e\u003ctt\u003ePostgrex.Notifications\u003c/tt\u003e sanitizes channel names with \u003ctt\u003equote_channel/1\u003c/tt\u003e, which doubles double quotes so the name is safe inside a double-quoted identifier. This protects the single-statement \u003ctt\u003eLISTEN\u003c/tt\u003e and \u003ctt\u003eUNLISTEN\u003c/tt\u003e paths. On every (re)connect, however, \u003ctt\u003ehandle_connect/1\u003c/tt\u003e replays all registered channels at once by concatenating their \u003ctt\u003eLISTEN\u003c/tt\u003e statements and wrapping them in a dollar-quoted anonymous code block (\u003ctt\u003eDO $$BEGIN ... END$$\u003c/tt\u003e). \u003ctt\u003equote_channel/1\u003c/tt\u003e does not escape the \u003ctt\u003e$$\u003c/tt\u003e dollar-quote delimiter that opens and closes this block.\u003c/p\u003e\u003cp\u003eThe \u003ctt\u003elisten/3\u003c/tt\u003e guards only reject null bytes and names longer than 63 bytes, so a channel name containing \u003ctt\u003e$$\u003c/tt\u003e passes validation unchanged. Once such a name is embedded, its \u003ctt\u003e$$\u003c/tt\u003e prematurely terminates the outer dollar-quoted string and PostgreSQL parses the remainder as additional top-level statements. Because \u003ctt\u003ehandle_connect/1\u003c/tt\u003e runs on every (re)connect, the malformed replay query is rejected each time and the notification connection never re-establishes its subscriptions, silently dropping notifications for every channel sharing that connection.\u003c/p\u003e\u003cp\u003eAn application is affected when it passes untrusted input (for example a tenant or user identifier) as a channel name to \u003ctt\u003ePostgrex.Notifications.listen/3\u003c/tt\u003e. The double-quote doubling prevents forming a fully valid injected statement, so arbitrary SQL execution is not possible, but the corrupted query reliably breaks the shared notification connection for all tenants, resulting in denial of service.\u003c/p\u003e\u003cp\u003eThis issue affects postgrex: from 0.16.0 before 0.22.3.\u003c/p\u003e"
            }
          ],
          "value": "SQL Injection vulnerability in elixir-ecto postgrex allows an attacker who can influence a LISTEN channel name to inject SQL into the reconnect replay query, causing a denial of service of the notification connection.\n\nPostgrex.Notifications sanitizes channel names with quote_channel/1, which doubles double quotes so the name is safe inside a double-quoted identifier. This protects the single-statement LISTEN and UNLISTEN paths. On every (re)connect, however, handle_connect/1 replays all registered channels at once by concatenating their LISTEN statements and wrapping them in a dollar-quoted anonymous code block (DO $$BEGIN ... END$$). quote_channel/1 does not escape the $$ dollar-quote delimiter that opens and closes this block.\n\nThe listen/3 guards only reject null bytes and names longer than 63 bytes, so a channel name containing $$ passes validation unchanged. Once such a name is embedded, its $$ prematurely terminates the outer dollar-quoted string and PostgreSQL parses the remainder as additional top-level statements. Because handle_connect/1 runs on every (re)connect, the malformed replay query is rejected each time and the notification connection never re-establishes its subscriptions, silently dropping notifications for every channel sharing that connection.\n\nAn application is affected when it passes untrusted input (for example a tenant or user identifier) as a channel name to Postgrex.Notifications.listen/3. The double-quote doubling prevents forming a fully valid injected statement, so arbitrary SQL execution is not possible, but the corrupted query reliably breaks the shared notification connection for all tenants, resulting in denial of service.\n\nThis issue affects postgrex: from 0.16.0 before 0.22.3."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-10T12:50:40.297Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-4mw9-4qgj-m97w"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-58225.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-58225"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/postgrex/commit/795c6062f62c4394272ff4b89170688857b4f841"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eValidate channel names before passing untrusted input to \u003ctt\u003ePostgrex.Notifications.listen/3\u003c/tt\u003e. Reject any name that contains the dollar-quote delimiter (\u003ctt\u003e$$\u003c/tt\u003e), or restrict channel names to a safe character set such as alphanumeric characters and underscores.\u003c/p\u003e"
            }
          ],
          "value": "Validate channel names before passing untrusted input to Postgrex.Notifications.listen/3. Reject any name that contains the dollar-quote delimiter ($$), or restrict channel names to a safe character set such as alphanumeric characters and underscores."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-58225",
    "datePublished": "2026-07-10T10:51:46.978Z",
    "dateReserved": "2026-06-29T18:54:08.633Z",
    "dateUpdated": "2026-07-10T12:50:40.297Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-32687",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-12T19:44:22.093287Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-12T19:44:35.571Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://repo.hex.pm",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "postgrex",
          "packageURL": "pkg:hex/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex.git",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "0.22.2",
              "status": "affected",
              "version": "0.16.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://github.com",
          "cpes": [
            "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "\u0027Elixir.Postgrex.Notifications\u0027"
          ],
          "packageName": "elixir-ecto/postgrex",
          "packageURL": "pkg:github/elixir-ecto/postgrex",
          "product": "postgrex",
          "programFiles": [
            "lib/postgrex/notifications.ex"
          ],
          "programRoutines": [
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:listen/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3"
            },
            {
              "name": "\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1"
            }
          ],
          "repo": "https://github.com/elixir-ecto/postgrex.git",
          "vendor": "elixir-ecto",
          "versions": [
            {
              "lessThan": "7cdedbd4316bb65f82e6a9a4f922c0ac491cb770",
              "status": "affected",
              "version": "266b530faf9bde094e31e0e4ab851f933fadc0f5",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe application must call \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e or \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e with a channel name derived from untrusted user input.\u003c/p\u003e"
            }
          ],
          "value": "The application must call \u0027Elixir.Postgrex.Notifications\u0027:listen/3 or \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 with a channel name derived from untrusted user input."
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "0.22.2",
                  "versionStartIncluding": "0.16.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Peter Ullrich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027\u003c/tt\u003e module) allows SQL Injection.\u003cp\u003eThe \u003ctt\u003echannel\u003c/tt\u003e argument passed to \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e and \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e is interpolated directly into \u003ctt\u003eLISTEN \"...\"\u003c/tt\u003e / \u003ctt\u003eUNLISTEN \"...\"\u003c/tt\u003e SQL statements without escaping the \u003ctt\u003e\"\u003c/tt\u003e character. An attacker who can influence the channel name can inject a \u003ctt\u003e\"\u003c/tt\u003e to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. \u003ctt\u003e; DROP TABLE ...; --\u003c/tt\u003e). The same unsanitized interpolation also occurs in \u003ctt\u003ehandle_connect/1\u003c/tt\u003e when replaying LISTEN commands after a reconnect.\u003c/p\u003e\u003cp\u003eThis vulnerability is associated with program file \u003ctt\u003elib/postgrex/notifications.ex\u003c/tt\u003e and program routines \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:listen/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:unlisten/3\u003c/tt\u003e, \u003ctt\u003e\u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects postgrex: from 0.16.0 before 0.22.2.\u003c/p\u003e"
            }
          ],
          "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027) vulnerability in elixir-ecto postgrex (\u0027Elixir.Postgrex.Notifications\u0027 module) allows SQL Injection.\n\nThe channel argument passed to \u0027Elixir.Postgrex.Notifications\u0027:listen/3 and \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3 is interpolated directly into LISTEN \"...\" / UNLISTEN \"...\" SQL statements without escaping the \" character. An attacker who can influence the channel name can inject a \" to break out of the quoted identifier and append arbitrary SQL. Because the notifications connection uses the PostgreSQL simple query protocol, multi-statement payloads are accepted, allowing DDL and DML commands to be chained (e.g. ; DROP TABLE ...; --). The same unsanitized interpolation also occurs in handle_connect/1 when replaying LISTEN commands after a reconnect.\n\nThis vulnerability is associated with program file lib/postgrex/notifications.ex and program routines \u0027Elixir.Postgrex.Notifications\u0027:listen/3, \u0027Elixir.Postgrex.Notifications\u0027:unlisten/3, \u0027Elixir.Postgrex.Notifications\u0027:handle_connect/1.\n\nThis issue affects postgrex: from 0.16.0 before 0.22.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66 SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-24T14:16:18.902Z",
        "orgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
        "shortName": "EEF"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory",
            "related"
          ],
          "url": "https://github.com/elixir-ecto/ecto/security/advisories/GHSA-r73h-97w8-m54h"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://cna.erlef.org/cves/CVE-2026-32687.html"
        },
        {
          "tags": [
            "related"
          ],
          "url": "https://osv.dev/vulnerability/EEF-CVE-2026-32687"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/elixir-ecto/postgrex/commit/7cdedbd4316bb65f82e6a9a4f922c0ac491cb770"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "SQL injection via channel name in Postgrex.Notifications.listen/3 and unlisten/3",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "6b3ad84c-e1a6-4bf7-a703-f496b71e49db",
    "assignerShortName": "EEF",
    "cveId": "CVE-2026-32687",
    "datePublished": "2026-05-12T14:18:07.607Z",
    "dateReserved": "2026-03-13T09:12:14.475Z",
    "dateUpdated": "2026-07-24T14:16:18.902Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}