CVE-2026-58225 SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

🗓️ 10 Jul 2026 10:51:46Reported by EEFType

SQL injection in Postgrex.Notifications can cause denial of service via unescaped dollar-quote during reconnect replay.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-58225	10 Jul 202610:51	–	attackerkb
Circl	CVE-2026-58225	10 Jul 202612:34	–	circl
CVE	CVE-2026-58225	10 Jul 202610:51	–	cve
EUVD	EUVD-2026-42867	10 Jul 202610:51	–	euvd
NVD	CVE-2026-58225	10 Jul 202611:16	–	nvd
Positive Technologies	PT-2026-57152	10 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-58225 SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service	10 Jul 202610:51	–	vulnrichment

[
  {
    "collectionURL": "https://repo.hex.pm",
    "cpes": [
      "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Postgrex.Notifications'"
    ],
    "packageName": "postgrex",
    "packageURL": "pkg:hex/postgrex",
    "product": "postgrex",
    "programFiles": [
      "lib/postgrex/notifications.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Postgrex.Notifications':handle_connect/1"
      },
      {
        "name": "'Elixir.Postgrex.Notifications':listen/3"
      }
    ],
    "repo": "https://github.com/elixir-ecto/postgrex",
    "vendor": "elixir-ecto",
    "versions": [
      {
        "lessThan": "0.22.3",
        "status": "affected",
        "version": "0.16.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:elixir-ecto:postgrex:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "'Elixir.Postgrex.Notifications'"
    ],
    "packageName": "elixir-ecto/postgrex",
    "packageURL": "pkg:github/elixir-ecto/postgrex",
    "product": "postgrex",
    "programFiles": [
      "lib/postgrex/notifications.ex"
    ],
    "programRoutines": [
      {
        "name": "'Elixir.Postgrex.Notifications':handle_connect/1"
      },
      {
        "name": "'Elixir.Postgrex.Notifications':listen/3"
      }
    ],
    "repo": "https://github.com/elixir-ecto/postgrex",
    "vendor": "elixir-ecto",
    "versions": [
      {
        "lessThan": "795c6062f62c4394272ff4b89170688857b4f841",
        "status": "affected",
        "version": "266b530faf9bde094e31e0e4ab851f933fadc0f5",
        "versionType": "git"
      }
    ]
  }
]

Source	Link
cna	www.cna.erlef.org/cves/CVE-2026-58225.html
github	www.github.com/elixir-ecto/postgrex/commit/795c6062f62c4394272ff4b89170688857b4f841
osv	www.osv.dev/vulnerability/EEF-CVE-2026-58225
github	www.github.com/elixir-ecto/ecto/security/advisories/GHSA-4mw9-4qgj-m97w

10 Jul 2026 12:50Current

CVSS 42.1

CWE-89