---
id: CVE-2018-18482
aliases:
  - GHSA-vm3q-58wm-2r2x
  - PYSEC-2018-154
  - PYSEC-2026-895
title: libpg_query memory leak
summary: libpg_query memory leak
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'
vendor: pg-query
product: pg-query
ecosystem: pip
affected:
  - pg-query < 0.28
  - pglast < 0.28
patched:
  - pg-query 0.28
  - pglast 0.28
published: '2022-05-13'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-vm3q-58wm-2r2x'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2018-18482'
  - url: 'https://github.com/lfittl/libpg_query/issues/49'
  - url: 'https://github.com/lelit/pglast'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/pg-query/PYSEC-2018-154.yaml
tags:
  - osv
  - pip
epss: 0.01273
epssPercentile: 0.68131
ingestedAt: '2026-07-08T18:25:53.338Z'
---

## Overview

An issue was discovered in libpg_query 10-1.0.2. There is a memory leak in pg_query_raw_parse in pg_query_parse.c, which might lead to a denial of service.

## Affected packages

- `pg-query < 0.28`
- `pglast < 0.28`

## Remediation

Upgrade to a patched release:

- `pg-query 0.28`
- `pglast 0.28`