CVE-2021-23222: PostgreSQL

Medium severity, CVSS 5.9. EPSS: 1.5% chance of exploitation in the next 30 days.

A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption.

Affected products

• PostgreSQL PostgreSQL: from 9.6, before 9.6.24 (fixed in 9.6.24); from 10.0, before 10.19 (fixed in 10.19); from 11.0, before 11.14 (fixed in 11.14); from 12.0, before 12.9 (fixed in 12.9); from 13.0, before 13.5 (fixed in 13.5); version 14.0 only

Published 2022-03-02. Last modified 2026-06-17.