ALPINE-CVE-2026-116312: Medium severity alpine/postgresql15 vulnerability

Q: Which PostgreSQL installations are affected?

The issue affects PostgreSQL 15 through 18 before 15.20, 16.16, 17.12, and 18.7. PostgreSQL versions before 15 are unaffected.

Q: What conditions are required to exploit this issue?

An attacker needs privileges to perform a table data modification and must be able to execute a MERGE against a partitioned table. The MERGE must perform an INSERT before an UPDATE, and an AFTER trigger must process the resulting transition state.

Q: What is the potential impact?

An AFTER trigger can process the wrong new row because transition-capture state is inconsistent. This can lead to limited confidentiality and integrity impact, with no stated availability impact.

Published Nov 12, 2026

Updated

Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.

Affected Software

12 affected componentsFixes available

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql18<18.7-r0

18.7-r0

alpine/postgresql18<18.7-r0

18.7-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/postgresql15 to a version that resolves this vulnerability.
Fixed in 15.20-r0
Upgrade
Upgrade alpine/postgresql16 to a version that resolves this vulnerability.
Fixed in 16.16-r0
Upgrade
Upgrade alpine/postgresql17 to a version that resolves this vulnerability.
Fixed in 17.12-r0
Upgrade
Upgrade alpine/postgresql18 to a version that resolves this vulnerability.
Fixed in 18.7-r0
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade postgresql to a version that resolves this vulnerability.
Fixed in 15.20

Event History

Nov 12, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which PostgreSQL installations are affected?

The issue affects PostgreSQL 15 through 18 before 15.20, 16.16, 17.12, and 18.7. PostgreSQL versions before 15 are unaffected.

What conditions are required to exploit this issue?

An attacker needs privileges to perform a table data modification and must be able to execute a MERGE against a partitioned table. The MERGE must perform an INSERT before an UPDATE, and an AFTER trigger must process the resulting transition state.

What is the potential impact?

An AFTER trigger can process the wrong new row because transition-capture state is inconsistent. This can lead to limited confidentiality and integrity impact, with no stated availability impact.

ALPINE-CVE-2026-116312: Medium severity alpine/postgresql15 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which PostgreSQL installations are affected?

What conditions are required to exploit this issue?

What is the potential impact?

Company

Resources

Contact

Frequently Asked Questions

Which PostgreSQL installations are affected?

What conditions are required to exploit this issue?

What is the potential impact?