The vulnerability lies in PostgreSQL’s pgcrypto module when the OpenSSL library is configured to disable certain ciphers. In these conditions, data encrypted with functions such as pgp_sym_encrypt or pgp_pub_encrypt is written to the database in cleartext, and decryption can still succeed even with an incorrect key. This defeats the intended confidentiality and limited integrity protection of the Modification Detection Code and enables an attacker to recover plain data by simply viewing the faulty ciphertext. The weakness is categorized as cryptographic key‐management and sensitive data exposure, matching CWE‑313 and CWE‑345.

Affected versions are PostgreSQL releases prior to 18.5, 17.11, 16.15, 15.19, and 14.24. The functions impacted are pgp_sym_encrypt, pgp_sym_decrypt, pgp_pub_encrypt, pgp_pub_decrypt, pgp_sym_encrypt_bytea, pgp_sym_decrypt_bytea, pgp_pub_encrypt_bytea, and pgp_pub_decrypt_bytea, all of which can be used in standard database applications running on these versions.

The CVSS score of 6.5 indicates moderate to high risk, and while the EPSS score is not available, the vulnerability has been documented as not in CISA’s KEV catalog. Attackers can exploit the flaw by executing any of the affected pgcrypto functions with user data; the decryption succeeds even when the key is wrong, revealing cleartext. Because the flaw is in the database engine itself, the attack requires only that the attacker has database access sufficient to run the affected functions, making the exploitation straightforward once the environment is configured with disabled OpenSSL ciphers.