CVE-2025-1094
CVE-2025-1094 is a high-severity vulnerability with a CVSS 3.x base score of 8.1. Its EPSS exploit-prediction score of 89% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-149.
Key facts
- Severity: High (CVSS 3.x base score 8.1)
- EPSS exploit prediction: 89% (100th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-1999
- Weakness: CWE-149
- Published:
- Last modified:
Description
Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
Frequently asked questions
- What is CVE-2025-1094?
- Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the application to use the function result to construct input to psql, the PostgreSQL interactive terminal. Similarly, improper neutralization of quoting syntax in PostgreSQL command line utility programs allows a source of command line arguments to achieve SQL injection when client_encoding is BIG5 and server_encoding is one of EUC_TW or MULE_INTERNAL. Versions before PostgreSQL 17.3, 16.7, 15.11, 14.16, and 13.19 are affected.
- How severe is CVE-2025-1094?
- CVE-2025-1094 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2025-1094 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 89% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-1094?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- Does CVE-2025-1094 have an EU (EUVD) identifier?
- Yes. CVE-2025-1094 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-1999.
- When was CVE-2025-1094 published?
- CVE-2025-1094 was published on 2025-02-13 and last updated on 2026-06-17.
References
- https://www.postgresql.org/support/security/CVE-2025-1094/
- http://www.openwall.com/lists/oss-security/2025/02/16/3
- http://www.openwall.com/lists/oss-security/2025/02/20/1
- https://lists.debian.org/debian-lts-announce/2025/02/msg00015.html
- https://lists.debian.org/debian-lts-announce/2025/02/msg00024.html
- https://security.netapp.com/advisory/ntap-20250221-0010/
Other CWE-149 vulnerabilities
- CVE-2018-25135 — Critical (CVSS 9.8): Anviz AIM CrossChex Standard 4.3.6.0 contains a CSV injection vulnerability that allows attackers to execute commands…
- CVE-2026-42511 — High (CVSS 8.1): The BOOTP file field is written to the lease file without escaping embedded double-quotes, allowing injection of…
- CVE-2025-43878 — Medium (CVSS 6.0): When running in Appliance mode, an authenticated attacker assigned the Administrator or Resource Administrator role may…
- CVE-2023-36479 — Low (CVSS 3.5): Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a…