ALPINE-CVE-2026-116321: Medium severity alpine/postgresql15 vulnerability
Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be a database user with privileges to change a fixed-length name value and pass it to code that handles the value as a C string. The supplied vector indicates network reachability, low attack complexity, and required low privileges, with no user interaction required.
Which PostgreSQL versions need remediation?
PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.
What is the impact of successful exploitation?
Successful exploitation can disclose server memory. The provided severity vector indicates low confidentiality impact and no integrity or availability impact.