Databricks Patches PostGIS Bug in Managed Postgres

Databricks has successfully mitigated a memory-safety vulnerability within the open-source PostGIS address_standardizer extension. Discovered by Mehmet Ince, the chief technology officer of threat-intelligence firm PRODAFT, the flaw affected managed PostgreSQL platforms, including Lakebase Postgres and Neon. Because Databricks utilizes a microVM architecture to isolate compute instances, the vulnerability did not result in any cross-customer data exposure on its platform.

The flaw in the address_standardizer extension—a tool used to normalize unstructured address data—stemmed from a classic out-of-bounds memory access issue. A caller-controlled value within a grammar rule was used to index into a fixed-size internal array without a proper bounds check. Because the extension is accessible to standard tenant roles without elevated privileges, any ordinary user could trigger the vulnerable code path, making it a significant risk for managed database providers.

Rather than waiting for an upstream open-source release, Databricks leveraged its custom extension build system to apply a downstream patch immediately. This allowed the company to secure Lakebase and Neon tenants without requiring customer action. Meanwhile, the upstream PostGIS project had initially released a partial patch under the guise of a minor memory-leak fix without a CVE. Ince identified where this initial fix fell short and submitted additional code upstream to fully secure the broader Postgres ecosystem.

For database administrators and platform engineers, this incident highlights the security risks of shipping third-party open-source components. Databricks emphasizes that managed service providers must take responsibility for the entire software stack they expose to users. Practitioners should maintain the capability to apply downstream patches independently of upstream release cycles, ensuring they can protect customers immediately when vulnerabilities are discovered in external dependencies.