PostgreSQL libpq SQL Injection in Client Applications (CVE-2025-1094)

CVE-2025-1094 is a SQL injection flaw in PostgreSQL's libpq when applications build dynamic SQL from untrusted input without proper escaping. Attackers who control query fragments can escalate to database superuser or read secrets on Linux app servers using vulnerable drivers.

Affected versions

• PostgreSQL 17.x before 17.3
• PostgreSQL 16.x before 16.7
• PostgreSQL 15.x before 15.11
• Apps using psycopg2, JDBC, or PHP pgsql with string-concatenated SQL

Verify patch level

psql --version
sudo -u postgres psql -c "SELECT version();"
rpm -q postgresql-server 2>/dev/null || dpkg -l postgresql

Remediation

• Upgrade PostgreSQL server and client packages from your distro
• Use parameterized queries / prepared statements in all app code
• Revoke SUPERUSER from application DB roles
• Audit pg_stat_activity for unusual COPY or file-access functions

Patch both server and client libraries — container images often lag behind host DB.