ALPINE-CVE-2026-116315: Buffer Overflow
Heap-based buffer overflow in PostgreSQL tsvectordelete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs to be able to act as a database user. Successful exploitation can execute arbitrary code as the operating system user that runs the PostgreSQL database.
Which PostgreSQL versions are affected?
Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What input is required to trigger the issue?
The attacker must use tsvector_delete() with a tsvector whose lexeme data has a nonstandard but valid ordering that requires additional alignment padding in the result.