Collaboration makes us all stronger

Summary

An external researcher, Mehmet Ince, reported a memory-safety flaw in PostGIS’s address_standardizer extension, where caller-controlled grammar data indexed a fixed-size array without bounds checking. Because the extension was available to ordinary tenant roles on managed Postgres services, Databricks treated the issue as a platform exposure rather than a third-party problem, while noting that its microVM architecture meant the exploit did not produce cross-customer impact on Lakebase Postgres and Neon. Detection alerted the Neon team during testing, enabling rapid validation and downstream patching while a durable fix was developed and deployed to protect tenants without customer action. The upstream fix initially missed cases; Mehmet supplied the remaining pieces, and the complete correction was returned to PostGIS, with his bounty donated and matched for the project.

Context

A researcher found a memory-safety vulnerability in the widely deployed PostGIS address_standardizer extension. The vulnerable code path was reachable by an ordinary tenant role because customers could install and use the extension without special privileges, creating exposure for managed Postgres platforms.

Approach / What changed

Databricks validated the report against Neon’s PostGIS version, patched its downstream extension builds independently of the upstream release timeline, and deployed a hardened fix to Neon and Lakebase tenants. Mehmet then submitted missing cases to PostGIS so the root cause was fixed for the broader open-source ecosystem.

Takeaways

• The vulnerability came from using caller-controlled grammar data to index a fixed-size internal array without a bounds check, creating an out-of-bounds memory access.
• Databricks treated vulnerabilities in an open-source component exposed to its tenants as its own platform responsibility and used downstream patching to protect customers before an upstream release.
• The initial upstream fix did not cover every case; Mehmet supplied the remaining corrections, while donating and matching his bounty to support the PostGIS project.

Related reading