Databricks & Neon Detail Collaborative Fix for PostGIS Memory Safety Vulnerability
Databricks and Neon collaborated with an external security researcher to identify and mitigate a memory-safety vulnerability in the open-source PostGIS address_standardizer extension. This bug was reachable by any tenant on managed Postgres platforms, including Lakebase Postgres and Neon, though Databricks' architecture limited cross-customer impact. Databricks rapidly deployed a downstream patch to protect its customers and contributed a comprehensive fix upstream to secure the broader Postgres ecosystem. The case study highlights a model for responsible disclosure and proactive vendor response to third-party open-source vulnerabilities.
- →Discovery of PostGIS Address Standardizer Memory Safety Bug
- →Collaborative Disclosure and Rapid Mitigation
- →Upstream Contribution to Secure the Broader Ecosystem
Security (1) ›
- Discovery of PostGIS Address Standardizer Memory Safety Bug
An external security researcher, Mehmet Ince, discovered a memory-safety flaw in the PostGIS address_standardizer extension, widely deployed on managed Postgres platforms like Lakebase Postgres and Neon. This flaw allowed an ordinary customer role to trigger an out-of-bounds memory access by indexing into a fixed-size internal array without a bounds check.
Notes (2) ›
- Collaborative Disclosure and Rapid Mitigation
Databricks and Neon proactively engaged with the researcher, validating the vulnerability and rapidly deploying a downstream patch to protect customers immediately. Databricks' microVM architecture for Lakebase Postgres prevented cross-customer data exposure, limiting the impact on its platform.
- Upstream Contribution to Secure the Broader Ecosystem
A comprehensive fix for the memory-safety vulnerability was ultimately contributed upstream to the PostGIS open-source project, securing the broader Postgres ecosystem for all users. The researcher generously donated their bug bounty back to the volunteer PostGIS maintainers, fostering open-source community support.
https://www.databricks.com/blog/collaboration-makes-us-all-stronger
Related releases
- Databricks details how it cut $1.2M in AI agent waste with Unity Gateway tracing Databricks Blog ·
- Databricks Unity AI Gateway Adds Support for Anthropic Claude Fable 5.1 Databricks Release Notes ·
- Databricks Adds Cross-Workspace Access Control for Serverless Databricks Release Notes ·
- Databricks Model Serving Now Supports Zhipu AI GLM 5.3 Databricks Release Notes ·
- Genie One and Genie Agents Now Support OpenAI Models on Databricks Databricks Release Notes ·
- Databricks Runtime Receives Maintenance Updates Across Supported Versions Databricks Release Notes ·