Hi,

The following vulnerability was published for address-standardizer.

CVE-2026-90775[0]:
| PostGIS address_standardizer through 3.7.0 fails to validate the
| Weight parameter from caller-supplied rules tables before using it
| as an array index. Attackers can craft malicious rule rows with out-
| of-range Weight values to trigger out-of-bounds reads in the
| load_value array, causing the PostgreSQL backend process to crash
| and terminate all cluster sessions.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-90775
https://www.cve.org/CVERecord?id=CVE-2026-90775
[1] https://github.com/postgis/address_standardizer/pull/6
[2] https://github.com/postgis/address_standardizer/commit/a5cb4b1360a040973092f13b1af97a718e7e104a

Regards,
Salvatore