Thread

1. BUG #19054: Memory exhaustion vulnerability in PostgreSQL array operations leads to server crash

   PG Bug reporting form <noreply@postgresql.org> — 2025-09-15T20:00:12Z

   The following bug has been logged on the website:
   
   Bug reference:      19054
   Logged by:          sibo wu
   Email address:      sibowu@amazon.com
   PostgreSQL version: 17.6
   Operating system:   mac
   Description:        
   
   PostgreSQL's array implementation can lead to server crashes due to
   uncontrolled memory consumption during array operations. When performing
   continuous array modifications within a loop, the server eventually exhausts
   available memory and crashes, affecting all connected sessions.
   psql (17.6)
   Type "help" for help.
   DO
   $$
   DECLARE
     a_1  text[];
     a text;
     i bigint default 1;
   BEGIN
     a := repeat('A',pow(2,29)::int);
     while true
     loop
       a_1[i] := a;
       i := i + 1;
     END LOOP;
   END
   $$;
   
   server closed the connection unexpectedly
           This probably means the server terminated abnormally
           before or while processing the request.
   The connection to the server was lost. Attempting reset: Failed.
   The connection to the server was lost. Attempting reset: Failed.
   !?> quit
   
   

2. Re: BUG #19054: Memory exhaustion vulnerability in PostgreSQL array operations leads to server crash

   Laurenz Albe <laurenz.albe@cybertec.at> — 2025-09-15T20:30:17Z

   On Mon, 2025-09-15 at 20:00 +0000, PG Bug reporting form wrote:
   > PostgreSQL's array implementation can lead to server crashes due to
   > uncontrolled memory consumption during array operations. When performing
   > continuous array modifications within a loop, the server eventually exhausts
   > available memory and crashes, affecting all connected sessions.
   
   That's not a bug, that's a user error.
   For reliable operation, you have to disable Linux' memory overcommit.
   Then the kernel won't kill the database, but your query will receive an
   "out of memory" error and fail without any crashes.
   
   Yours,
   Laurenz Albe