SQL Injection in Postgrex via Malformed LISTEN Channel

Executive Summary

CVE-2026-58225 is a SQL injection vulnerability in the elixir-ecto postgrex library affecting versions from 0.16.0 before 0.22.3. It occurs when an attacker can influence a LISTEN channel name used in Postgrex.Notifications.listen/3.

The vulnerability arises because the function quote_channel/1 properly escapes double quotes but does not escape PostgreSQL's dollar-quote delimiter ($$). When a channel name contains $$, it prematurely terminates the dollar-quoted anonymous code block used during connection replay queries.

This causes PostgreSQL to parse the remainder of the query as additional top-level statements, corrupting the reconnect replay query. As a result, the notification connection fails to re-establish subscriptions and silently drops notifications for all channels sharing that connection.

While arbitrary SQL execution is not possible due to double-quote escaping, the corrupted query reliably causes a denial of service by breaking the shared notification connection.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) on the notification connection used by Postgrex.Notifications. When exploited, the reconnect replay query is corrupted and rejected by PostgreSQL on every (re)connect.

As a result, the notification connection never re-establishes its subscriptions, silently dropping notifications for all channels sharing that connection.

Applications that pass untrusted input, such as tenant or user identifiers, as channel names to Postgrex.Notifications.listen/3 are affected.

The impact is service disruption rather than arbitrary SQL execution, causing loss of notifications and potentially affecting all tenants or users relying on that connection.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying if your application uses Postgrex versions from 0.16.0 before 0.22.3 and if untrusted input is passed as channel names to Postgrex.Notifications.listen/3.

You can check your Postgrex version by running a command in your project environment, for example:

• mix deps | grep postgrex

To detect if vulnerable channel names containing the dollar-quote delimiter ($$) are used, you can search your application logs or database notification channel registrations for channel names containing $$.

• grep '\$\$' your_application_logs.log

Additionally, monitoring for repeated notification connection failures or denial of service symptoms related to Postgrex notifications may indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Postgrex to version 0.22.3 or later, where the vulnerability is fixed by properly escaping dollar signs in channel names.

If upgrading is not immediately possible, you should validate and sanitize channel names before passing them to Postgrex.Notifications.listen/3 to ensure they do not contain the dollar-quote delimiter ($$) or other unsafe characters.

Restricting channel names to a safe character set that excludes the $ character can prevent injection attempts.

Monitoring and alerting on notification connection failures can help detect ongoing exploitation attempts.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability causes a denial of service by breaking the notification connection, which can silently drop notifications for all channels sharing that connection.

While arbitrary SQL execution is not possible, the denial of service could impact the availability of notification services that might be critical for compliance with standards requiring data availability and integrity, such as GDPR or HIPAA.

However, there is no direct information in the provided context or resources about specific impacts on compliance with GDPR, HIPAA, or other regulations.

Useful 0 Not Useful 0