CVE-2026-17543 is a critical (CVSS 9.8) SQL injection in the PHP pgsql extension, caused by improper escaping of backslashes. It affects PHP 8.2 before 8.2.33, 8.3 before 8.3.33, 8.4 before 8.4.24 and 8.5 before 8.5.9. Update to a fixed version and check code that uses the pg convenience functions.
What's affected
PHP, by branch:
- 8.2 before 8.2.33
- 8.3 before 8.3.33
- 8.4 before 8.4.24
- 8.5 before 8.5.9
The problem is in the ext/pgsql extension. The advisory names the helper php_pgsql_convert(), which the functions pg_insert(), pg_update(), pg_select() and pg_delete() use to escape the values they are given. Code that does not call those four functions does not use that helper. The advisory scores it as High, and the record shows 9.8.
Fixed versions are the first release in each branch that is at or above the numbers above. Linux distributions may backport the fix without changing the version number, so also read your distribution's advisory.
How to check if you're exposed
Check the PHP version on each host and container, and whether the pgsql extension is loaded.
php -v
php -m | grep -i pgsql
Then search your code for the four functions named in the advisory.
grep -rnE "pg_(insert|update|select|delete)\(" --include=*.php .
A match in an application that runs a version below the fixed ones is the case to fix first. The advisory describes the issue under PostgreSQL's default setting for standard_conforming_strings, which is on since PostgreSQL 9.1. Also check your dependency lock files and base images, since the PHP version often comes from a container image.
What to do now
- List PHP versions in use, including base images, CI images and hosting plans.
- Upgrade to 8.2.33, 8.3.33, 8.4.24 or 8.5.9 or later, or to the distribution package that carries the fix.
- Search code for pg_insert, pg_update, pg_select and pg_delete, and note which take user input.
- Where you can, switch those calls to prepared statements with bound parameters.
- Rebuild and redeploy images, then rescan to confirm no old PHP layers remain.
Why it matters
The weakness is CWE-89 (SQL Injection). The helper escaped a value with the PostgreSQL client library and then wrapped it in an escape string constant, written as E followed by quotes. With standard_conforming_strings on, the library does not escape backslashes in the way that constant expects, so a backslash in the input could cancel the protection on a quote and let the rest of the value be read as SQL. The fix wraps values in ordinary string constants instead.
The vector shows a network attack with no login, low complexity and no user interaction, and high impact on all three goals, which is why it scores 9.8. Weaknesses in a language runtime are harder to spot than ones in your own code, because the code looks correct. An inventory of runtime versions tells you where to look. CISA does not list this CVE as known exploited.
Try it yourself
Runtime versions hide in images and lock files. This demo shows a dependency inventory answering where a vulnerable version lives.
Click through it at your own pace, or open it full screen.
Quick check
Does this affect PDO or prepared statements?
The advisory names the pg_insert, pg_update, pg_select and pg_delete functions and their shared helper. It does not name PDO or prepared statements.
Can I scan for this without installing anything?
You can check your dependencies for known CVEs with the free in-browser scan at https://gold.safeguard.sh/scan, then confirm runtime versions on your hosts.
Sources
Last reviewed: 19 October 2026.
