CVE-2026-13455

Published: Jun 30, 2026Modified: Jul 6, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 (Secondary)

Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions

Affected (1)

Products: Dalibo: Postgresql Anonymizer

1 product

Postgresql Anonymizer

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Dalibo Postgresql Anonymizer	Up to 3.1.2

Related CWEs

Use of Weak Hash

The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

References (1)

https://gitlab.com/dalibo/postgresql_anonymizer/-/issues/649

Source: f86ef6dc-4d3a-42ad-8f28-e6d5547a5007

Vendor Advisory

Timeline

No history available yet.