CVE-2021-32027

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, missing bounds checks let authenticated database users write arbitrary bytes to a wide area of server memory. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-320286.5A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database CVE-2021-320296.5A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read CVE-2021-320309.8The administrator application on ASUS GT-AC2900 devices before 3.0.0.4.386.42643 and Lyra Mini before 3.0.0.4_384_46630 allows authenticatio CVE-2021-320327.5In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the event of a failure) c CVE-2021-320334.6Protectimus SLIM NFC 70 10.01 devices allow a Time Traveler attack in which attackers can predict TOTP passwords in certain situations. The CVE-2021-320367.1An authenticated user without any specific authorizations may be able to repeatedly invoke the features command where at a high volume may l CVE-2021-320376.5An authorized user may trigger an invariant which may result in denial of service or server exit if a relevant aggregation request is sent t CVE-2021-320395.5Users with appropriate file access may be able to access unencrypted user credentials saved by MongoDB Extension for VS Code in a binary fil CVE-2021-32046.5SSRF in the document conversion component of Webware Webdesktop 5.1.15 allows an attacker to read all files from the server.CVE-2021-320407.5It may be possible to have an extremely long aggregation pipeline in conjunction with a specific stage/operator and cause a stack overflow d CVE-2021-320507.5Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an applicatio CVE-2021-320517.5Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.