CVE-2026-90775

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter taken from caller-supplied rules tables before using it as an index into the load_value array, resulting in out-of-bounds reads (CWE-125). An attacker who can insert or modify rule rows can craft entries with out-of-range Weight values that crash the PostgreSQL backend process and terminate all sessions on the cluster, making this a denial-of-service condition with no confidentiality or integrity impact (CVSS 4.0: 7.1, availability high). Anyone running the optional address_standardizer extension on PostgreSQL is affected, with the greatest risk where semi-trusted or lower-privileged database users are permitted to load custom rules tables. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade address_standardizer/PostGIS to a release newer than 3.7.0 as soon as a patched version ships; in the meantime, revoke INSERT/UPDATE privileges on address_standardizer rules tables from untrusted database roles so only administrators can load rules. Audit existing rules tables for anomalous Weight values and check PostgreSQL logs for unexplained backend crashes and session terminations.