ALPINE-CVE-2026-116325: SQL Injection
SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12
Event History
Frequently Asked Questions
Which PostgreSQL versions require remediation?
PostgreSQL 17 releases before 17.12 and PostgreSQL 18 releases before 18.7 are affected. Versions before PostgreSQL 17 are unaffected, including PostgreSQL 15 and 16.
What conditions are required for exploitation?
An attacker must be able to create a database object with a crafted index name. The vulnerable reindexdb invocation must use both --jobs and --index, and the injected SQL runs as the database user executing reindexdb.
What should be done if affected versions are in use?
Update PostgreSQL 17 to 17.12 or later, or PostgreSQL 18 to 18.7 or later. Until updating, avoid running reindexdb with the --jobs and --index combination against databases where untrusted users can create objects.