ALPINE-CVE-2026-116336: High severity alpine/postgresql15 vulnerability
Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25
Event History
Frequently Asked Questions
What level of database access does an attacker need?
An attacker needs privileges to create the relevant database object and to cause an index expression to issue DROP INDEX. The vulnerability does not describe exploitation by an unauthenticated user.
Which PostgreSQL releases contain the fix?
The issue is fixed in PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Versions before those releases are affected.
What is the impact if exploitation succeeds?
Successful exploitation allows arbitrary code execution as the operating system user that runs the PostgreSQL database server. This can compromise confidentiality, integrity, and availability of data and the database host context available to that user.