CVE-2025-12817

A vulnerability has been identified in PostgreSQL’s CREATE STATISTICS command where the database does not check that the user has the required schema CREATE privilege. A table owner user could create a statistics object in any schema, blocking other users who legitimately hold CREATE STATISTICS permissions from creating objects with the same name. This results in a denial-of-service of the statistics creation functionality.

This issue is rated Low severity by Red Hat Product Security, because exploitation is straightforward once an attacker already holds table-owner privileges. The attack complexity is Low, as no unusual conditions, timing requirements, or unpredictable states are needed; a table owner can simply choose any schema name and intentionally create a statistics object with a conflicting name, which is only trivial to perform and does not require prior knowledge beyond selecting an arbitrary identifier. The availability impact remains Low, since only the creation of a specific statistics object is blocked and normal database operations continue without disruption. There is no confidentiality or integrity impact, and the flaw does not allow privilege escalation. For these reasons, despite a Medium-range CVSS score, the overall impact to Red Hat products is considered Low.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.