CVE-2015-3165: Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x befo...

Security readout for executives and security teams

This PostgreSQL flaw can let a remote user crash an affected database service in a narrow SSL shutdown timing condition. It is primarily an availability risk: applications depending on the database could see outages. The provided sources do not show active exploitation or data theft impact. Exposure is most likely where legacy PostgreSQL versions accept remote SSL connections, especially internet-reachable or broadly reachable database listeners. Systems already on the named fixed releases or later are not indicated as affected by the provided sources. Treat as a practical availability fix for legacy PostgreSQL, not as confirmed active exploitation. Prioritize exposed or mission-critical databases first, especially if they run old 9.x branches and support SSL connections. Mitigation focus: Upgrade PostgreSQL to the fixed release for the deployed branch or later.; Apply distribution vendor updates from Ubuntu, Debian, Red Hat, Gentoo, or Apple where relevant.; Restrict PostgreSQL network exposure to trusted application hosts only..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.