CVE-2026-90775: Postgis Address Standardizer

Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days.

PostGIS address_standardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the load_value array, causing the PostgreSQL backend process to crash and terminate all cluster sessions.

Affected products

• Postgis Address Standardizer: up to and including 3.7.0

Published 2026-09-13. Last modified 2026-09-24.