CVE-2025-1735
pgsql extension does not check for errors during escaping
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
pgsql extension does not check for errors during escaping
In PHP versions:8.1.* before 8.1.33, 8.2.* before 8.2.29, 8.3.* before 8.3.23, 8.4.* pgsql and pdo_pgsql escaping functions do not check if the underlying quoting functions returned errors. This could cause crashes if Postgres server rejects the string as invalid.
Reserved 2025-02-27 | Published 2025-07-13 | Updated 2025-07-13 | Assigner phpCWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-476 NULL Pointer Dereference
Andres Freund
github.com/...hp-src/security/advisories/GHSA-hrwm-9436-5mv3
Support options
