CVE-2026-13455
—CVSS 3.1
4.3 medium
EPSS
<1%p9
Published
()
Modified
Description
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions
- Vendors
- dalibo
- Products
- postgresql anonymizer
- Weakness
- CWE-328
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
In the news0 stories
No ingested article mentions this CVE yet.