CVE-2025-8713
CVE-2025-8713 is a low-severity vulnerability with a CVSS 3.x base score of 3.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1230.
Key facts
- Severity: Low (CVSS 3.x base score 3.1)
- EPSS exploit prediction: 0% (11th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-24811
- Weakness: CWE-1230
- Published:
- Last modified:
Description
PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
Frequently asked questions
- What is CVE-2025-8713?
- PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data that a row security policy intended to hide. PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process. Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies. Reachable statistics data notably included histograms and most-common-values lists. CVE-2017-7484 and CVE-2019-10130 intended to close this class of vulnerability, but this gap remained. Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.
- How severe is CVE-2025-8713?
- CVE-2025-8713 has a CVSS 3.x base score of 3.1, rated low severity. It is exploitable over network with high attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
- Is CVE-2025-8713 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
- How do I fix CVE-2025-8713?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-8713 have an EU (EUVD) identifier?
- Yes. CVE-2025-8713 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-24811.
- When was CVE-2025-8713 published?
- CVE-2025-8713 was published on 2025-08-14 and last updated on 2026-06-17.
References
Other CWE-1230 vulnerabilities
- CVE-2024-9099 — High (CVSS 8.1): In lunary-ai/lunary version v1.4.29, the GET /projects API endpoint exposes both public and private API keys for all…
- CVE-2025-13084 — High (CVSS 7.6): The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys.…
- CVE-2025-47324 — High (CVSS 7.5): Information disclosure while accessing and modifying the PIB file of a remote device via powerline.
- CVE-2025-0330 — High (CVSS 7.5): In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error…
- CVE-2024-53291 — High (CVSS 7.5): Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensitive Information Through Metadata vulnerability. An…
- CVE-2025-30038 — High (CVSS 7.3): The vulnerability consists of a session ID leak when saving a file downloaded from CGM CLININET. The identifier is…