ALPINE-CVE-2026-116317: Buffer Overflow
Heap-based buffer overflow in PostgreSQL tsrankcd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
An attacker needs database-user access and must be able to supply an invalid tsvector containing duplicate positions. No user interaction is required.
Which PostgreSQL versions include the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Earlier releases in those branches are affected.
Which Alpine PostgreSQL packages are identified as affected?
The affected Alpine packages listed are alpine/postgresql15, alpine/postgresql16, alpine/postgresql17, and alpine/postgresql18.