CVE-2026-73514

Name of the Vulnerable Software and Affected Versions PostGIS address standardizer versions prior to 3.7.0

Description The address standardizer extension contains an out-of-bounds write issue. A database user capable of providing caller-controlled relation names to the standardize address() function can trigger memory corruption. This occurs when a rules table is provided with a classification Type value that exceeds the fixed class range. The oversized rule type value is used as an index into an internal output-link table without proper bounds checking, leading to an out-of-bounds write.

Recommendations Update to the version containing commit 423570b. Restrict the ability of users to supply caller-controlled relation names to the standardize address() function.