CVE-2021-32028: PostgreSQL

Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days.

A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of server memory. The highest threat from this vulnerability is to data confidentiality.

Affected products

• PostgreSQL PostgreSQL: from 9.6.0, before 9.6.22 (fixed in 9.6.22); from 10.0, before 10.17 (fixed in 10.17); from 11.0, before 11.12 (fixed in 11.12); from 12.0, before 12.7 (fixed in 12.7); from 13.0, before 13.3 (fixed in 13.3)

Published 2021-10-11. Last modified 2026-06-17.