Eymoutiers, France, October 27th, 2026
Dalibo is pleased to announce PostgreSQL Anonymizer 3.3 with a panel of
important security fixes.
Enhanced Privacy Protection for Your Data
PostgreSQL Anonymizer is an extension that hides or replaces personally
identifiable information (PII) or commercially sensitive data from a PostgreSQL
database.
The extension offers 6 different masking strategies:
Each strategy is complemented by an enhanced suite of Masking Functions, including
advanced techniques such as: Substitution, Randomization, Faking, Pseudonymization,
Partial Scrambling, Shuffling, Noise Addition and Generalization.
The extension can be installed with Debian and RPM packages, an Ansible role, a Docker
image, etc. You can use it on most major DBaaS providers including : Alibaba Cloud,
Crunchy Bridge, Google Cloud SQL, IBM Cloud, Microsoft Azure Database, Neon, Yandex
It is also available on some Postgres forks such as EDB Advanced Postgres, Greenplum
and Yugabyte.
See the INSTALL section of the documentation for more details!
Important Security Update
Version 3.3 includes fixes for 12 critical vulnerabilities allowing some users
to gain superuser privileges under certain circumstances or allowing masked
users to access personal information.
These vulnerabilities are declared below:
All users should upgrade the extension to version 3.3 as soon as possible.
Upgrade
Version 3.3 brings a series of new restrictions to prevent malicious behaviours.
- Subqueries in masking rules are now forbidden
- Inlining of functions is disabled for transparent dynamic masking
- With dynamic masking, masked role are forbidden from
executing function with SQL-standard bodies. This includes functions in
contrib extensions that use this form (citext, earthdistance, etc. )
It is also strongly advised to change the value of the anon.salt GUC parameter.
See the UPGRADE section for more details.
Acknowledgments
This release includes code, bugfixes, documentation, code reviews and ideas
from Alain Lesage, @dmeremyanin, Gregoire Hubert and other contributors.
Kudos to @dmeremyanin for his first contributions !
The security issues were reported by Alexander Kukushkin and Ilya Staroverov.
Many thanks to them for their efforts, their availability and the quality of
their work.
And also special thanks to the PGRX team for their amazing work!
Join our community to improve data privacy!
PostgreSQL Anonymizer is part of the [Dalibo Labs] initiative. It is mainly
developed by [Damien Clochard] and [Benoit Lobréau].
This is an open project, contributions are welcome. We need your feedback and
ideas! Let us know what you think of this tool, how it fits your needs and
what features are missing.
If you want to help, you can find a list of Junior Jobs.