CVE-2023-31136

PostgresNIO is a Swift client for PostgreSQL. Any user of PostgresNIO prior to version 1.14.2 connecting to servers with TLS enabled is vulnerable to a man-in-the-middle attacker injecting false responses to the client's first few queries, despite the use of TLS certificate verification and encryption. The vulnerability is addressed in PostgresNIO versions starting from 1.14.2. There are no known workarounds for unpatched users.

• CWE-522

• https://github.com/advisories/GHSA-467w-rrqc-395fNot Applicable
• https://github.com/advisories/GHSA-735f-7qx4-jqq5Not Applicable
• https://github.com/apple/swift-nio/pull/2419Patch
• https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7Patch
• https://github.com/vapor/postgres-nio/releases/tag/1.14.2Release Notes
• https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vvVendor Advisory
• https://www.postgresql.org/support/security/CVE-2021-23214/Not Applicable
• https://www.postgresql.org/support/security/CVE-2021-23222/Not Applicable
• https://github.com/advisories/GHSA-467w-rrqc-395fNot Applicable
• https://github.com/advisories/GHSA-735f-7qx4-jqq5Not Applicable
• https://github.com/apple/swift-nio/pull/2419Patch
• https://github.com/vapor/postgres-nio/commit/2df54bc94607f44584ae6ffa74e3cd754fffafc7Patch
• https://github.com/vapor/postgres-nio/releases/tag/1.14.2Release Notes
• https://github.com/vapor/postgres-nio/security/advisories/GHSA-9cfh-vx93-84vvVendor Advisory
• https://www.postgresql.org/support/security/CVE-2021-23214/Not Applicable
• https://www.postgresql.org/support/security/CVE-2021-23222/Not Applicable

Published

May 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-31130c-ares is an asynchronous resolver library. ares_inet_net_pt…6.4
• CVE-2023-31131Greenplum Database (GPDB) is an open source data warehouse b…9.1
• CVE-2023-31132Cacti is an open source operational monitoring and fault man…7.8
• CVE-2023-31133Ghost is an app for new-media creators with tools to build a…7.5
• CVE-2023-31134Tauri is software for building applications for multi-platfo…5.4
• CVE-2023-31135Dgraph is an open source distributed GraphQL database. Exist…5.5
• CVE-2023-31137MaraDNS is open-source software that implements the Domain N…7.5
• CVE-2023-31138DHIS2 Core contains the service layer and Web API for DHIS2,…6.5
• CVE-2023-31139DHIS2 Core contains the service layer and Web API for DHIS2,…7.5
• CVE-2023-3114Terraform Enterprise since v202207-1 did not properly implem…7.7
• CVE-2023-31140OpenProject is open source project management software. Star…6.5
• CVE-2023-31141OpenSearch is open-source software suite for search, analyti…5.9