libpg_query memory leak

published 2018-10-18 8 y ago modified 2026-07-07 4 mo ago also GHSA-vm3q-58wm-2r2x , PYSEC-2018-154 , PYSEC-2026-895 , EUVD-2018-0151

cvss: 6.5; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits: 0; none known

An issue was discovered in libpg_query 10-1.0.2. There is a memory leak in pg_query_raw_parse in pg_query_parse.c, which might lead to a denial of service.

Patch / fix

fixed in 2

pypi pg-query 0.28
pypi pglast 0.28

Exploit prediction

1.16% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/lfittl/libpg_query/issues/49 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P
GitHub	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
OSV	3.0	6.5	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
pypi	pg-query	<0.28	0.28
pypi	pglast	<0.28	0.28

Classification

Weakness

CWE-772 Missing Release of Resource after Effective Lifetime

References

github.com /lfittl/libpg_query/issues/49
web, exploit, third-party-advisory, report
nvd.nist.gov /vuln/detail/CVE-2018-18482
advisory
github.com /lelit/pglast
package
github.com /pypa/advisory-database/tree/main/vulns/pg-query/PYSEC-2018-154.yaml
web
pypi.org /project/pglast
package
github.com /advisories/GHSA-vm3q-58wm-2r2x
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary