ALPINE-CVE-2026-116309: High severity alpine/postgresql15 vulnerability
Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Which PostgreSQL release branches need updates?
Affected releases are earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What level of access does an attacker need?
The severity vector indicates that low privileges are required and no user interaction is required. The issue involves an object creator blessing a non-hash reference into PostgreSQL::InServer::ARRAY.
Is exploitation confirmed to produce a security impact?
No. The available information says it has not been confirmed or ruled out whether an attacker can control the pointer sufficiently to achieve security impact, but the issue is being handled as though that is possible.
How can I tell whether my deployment is affected?
Check the PostgreSQL major version and patch level. Deployments running 18 before 18.7, 17 before 17.12, 16 before 16.16, 15 before 15.20, or 14 before 14.25 are affected.