ALPINE-CVE-2026-116308: Medium severity alpine/postgresql15 vulnerability
Buffer over-read in PostgreSQL dictint allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be a database user, since exploitation requires low privileges. The issue can disclose portions of PostgreSQL server memory.
Which PostgreSQL releases need an update?
Affected versions are PostgreSQL 14 before 14.25, 15 before 15.20, 16 before 16.16, 17 before 17.12, and 18 before 18.7. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What input triggers the vulnerability?
The vulnerability is triggered through dict_int using a zero-length token. The provided data does not specify a workaround other than updating to a fixed version.