Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
psycopg/psycopg2
master @ 3a6d9d6
4
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Denial of Service: 1 prior fix. Scrutinize any change in this area.
psycopg/connection_int.c: most-fixed (1 issue). Treat as high-risk during review.
3 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
SQL Injection: Parameter names in callproc are concatenated into SQL without proper escaping, allowing an attacker to inject arbitrary SQL. The fix adds sanitization, but this pattern may recur in other stored-procedure or dynamic-query paths.
Use-After-Free: The PGresult is cleared before the value returned by PQgetvalue is used, leading to a use-after-free. This indicates a fragile pattern of result lifetime management that could affect other result-reading functions.
Denial of Service: Parsing malformed interval strings can cause integer overflow and an infinite loop, allowing a remote attacker to exhaust resources. The fix adds an overflow guard, but similar parsing loops in other type-casting functions may lack such checks.