CVE-2026-110183

PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking

State: Published
Severity: 4.3 Medium
Published: Oct 28, 2026
Updated: Oct 28, 2026
Reserved: Oct 13, 2026

Description

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

Scores

CVSS	Score	Vector	Source
3.1	4.3 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	PostgreSQL

Weaknesses

CWE-202 Exposure of Sensitive Information Through Data Queries

Affected Products

Product	Versions
PostgreSQL AnonymizerDALIBO	1 to before 3.3.0Affected

References

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/722

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.