psqlODBC fixes memory corruption from oversized parameter lists

psqlODBC 18.00.0005 fixes heap corruption caused by oversized bound-parameter lists. The PostgreSQL driver stored a parameter count in a signed 16-bit field; sufficiently large lists could corrupt memory or crash the application. Exposure matters when untrusted input controls list length. The fix rejects parameter numbers above 32,767; the maintainers recommend upgrading affected versions.

PostgreSQL ODBC team · Oct 14, 2026

Why it matters

Generated IN clauses can turn ordinary input size into a driver-level memory safety problem.

More context

Review versions 08.01.0102 through 18.00.0004. If an immediate upgrade is impossible, the advisory recommends bounding parameter counts or passing a long list as one array parameter.

Keep in mind

The advisory rates this medium severity and identifies an application-dependent exposure condition.

Original read