ALPINE-CVE-2026-116322: Medium severity alpine/postgresql15 vulnerability
Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authenticationtimeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
Only PostgreSQL 18 installations with a minor version earlier than 18.7 are affected. PostgreSQL versions before 18 are unaffected.
Does exploitation require authentication or user interaction?
No. The issue can be triggered by an unauthenticated network client and requires no user interaction.
What impact can an attacker achieve?
An attacker can trigger a server restart, causing a denial-of-service condition. The provided severity vector indicates availability impact only, with no confidentiality or integrity impact.
What conditions are needed to trigger the issue?
The attacker must arrange for authentication_timeout to occur while holding a spinlock during cancel handling.