PostgreSQL Anonymizer 3.3 : Major Security Update

Eymoutiers, France, October 27th, 2026

Dalibo is pleased to announce PostgreSQL Anonymizer 3.3 with a panel of important security fixes.

Enhanced Privacy Protection for Your Data

PostgreSQL Anonymizer is an extension that hides or replaces personally identifiable information (PII) or commercially sensitive data from a PostgreSQL database.

The extension offers 6 different masking strategies:

• Dynamic Masking - Real-time data protection
• Static Masking - Permanent data transformation
• Replica Masking - Anonymized logical replication
• Backup Masking - Privacy-protected database exports
• Masking Views - Controlled data visibility
• Masking Data Wrappers - Extended protection across systems

Each strategy is complemented by an enhanced suite of Masking Functions, including advanced techniques such as: Substitution, Randomization, Faking, Pseudonymization, Partial Scrambling, Shuffling, Noise Addition and Generalization.

The extension can be installed with Debian and RPM packages, an Ansible role, a Docker image, etc. You can use it on most major DBaaS providers including : Alibaba Cloud, Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon, Yandex It is also available on some Postgres forks such as EDB Advanced Postgres, Greenplum and Yugabyte.

See the INSTALL section of the documentation for more details!

Important Security Update

Version 3.3 includes fixes for 12 critical vulnerabilities allowing some users to gain superuser privileges under certain circumstances or allowing masked users to access personal information.

These vulnerabilities are declared below:

• CVE-2026-110181: Masked roles read the authentic data through SQL functions with a SQL-standard body
• CVE-2026-105615: Masked roles can read pg_stats
• CVE-2026-105616: The secret salt is readable in pg_db_role_setting
• CVE-2026-110183: After the static masking, pg_stats keeps the authentic values of the masked columns
• CVE-2026-105619: Masking rules are not applied through security_invoker views
• CVE-2026-105618: Dynamic masking does not work on inherited tables
• CVE-2026-110182: anon.partial() and anon.partial_email() can leak data
• CVE-2026-105617: Cached plans bypass transparent dynamic masking
• CVE-2026-105620: Unauthorized access via subqueries
• CVE-2026-105612: Data-modifying CTEs bypass the read-only restriction
• CVE-2026-105614: Unbounded memory allocation (DoS) in image functions
• CVE-2026-105613: DoS in range-based dummy functions

All users should upgrade the extension to version 3.3 as soon as possible.

Upgrade

Version 3.3 brings a series of new restrictions to prevent malicious behaviours.

• Subqueries in masking rules are now forbidden
• Inlining of functions is disabled for transparent dynamic masking
• With dynamic masking, masked role are forbidden from executing function with SQL-standard bodies. This includes functions in contrib extensions that use this form (citext, earthdistance, etc. )

It is also strongly advised to change the value of the anon.salt GUC parameter.

See the UPGRADE section for more details.

Acknowledgments

This release includes code, bugfixes, documentation, code reviews and ideas from Alain Lesage, @dmeremyanin, Gregoire Hubert and other contributors.

Kudos to @dmeremyanin for his first contributions !

The security issues were reported by Alexander Kukushkin and Ilya Staroverov. Many thanks to them for their efforts, their availability and the quality of their work.

And also special thanks to the PGRX team for their amazing work!

Join our community to improve data privacy!

PostgreSQL Anonymizer is part of the [Dalibo Labs] initiative. It is mainly developed by [Damien Clochard] and [Benoit Lobréau].

This is an open project, contributions are welcome. We need your feedback and ideas! Let us know what you think of this tool, how it fits your needs and what features are missing.

If you want to help, you can find a list of Junior Jobs.