ALPINE-CVE-2026-116310: Use After Free
Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. filefdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12
Event History
Frequently Asked Questions
Which deployed PostgreSQL versions are affected?
Within the 17 and 18 major release lines, versions before 17.12 and 18.7 are affected. PostgreSQL versions before 17 are unaffected.
What level of access does an attacker need?
An attacker needs database-user privileges. Exploitation involves COPY FROM error reporting with a longer input row after an ignored or nullified conversion error; file_fdw can reach the same path in affected PostgreSQL 18 deployments.
What is the impact of successful exploitation?
A successful attacker can disclose portions of PostgreSQL server memory. The provided vector indicates confidentiality impact only, with no stated integrity or availability impact.
How can I determine whether an installation needs remediation?
Check the PostgreSQL major and minor version. Upgrade affected 17.x installations to 17.12 or later and affected 18.x installations to 18.7 or later; installations running a major version before 17 are not affected.