ALPINE-CVE-2026-120139: High severity alpine/postgresql15 vulnerability

Q: Who can exploit this issue?

An attacker needs to be a database user with privileges sufficient to submit oversized tuple data. The attack can be carried out remotely and does not require user interaction.

Q: What is the impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution as the operating system user that runs the PostgreSQL database process. This can compromise the confidentiality, integrity, and availability of data accessible to that operating system account.

Q: Which PostgreSQL versions need to be updated?

Affected releases are versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.

Published Nov 12, 2026

Updated

Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

12 affected componentsFixes available

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql18<18.7-r0

18.7-r0

alpine/postgresql18<18.7-r0

18.7-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/postgresql15 to a version that resolves this vulnerability.
Fixed in 15.20-r0
Upgrade
Upgrade alpine/postgresql16 to a version that resolves this vulnerability.
Fixed in 16.16-r0
Upgrade
Upgrade alpine/postgresql17 to a version that resolves this vulnerability.
Fixed in 17.12-r0
Upgrade
Upgrade alpine/postgresql18 to a version that resolves this vulnerability.
Fixed in 18.7-r0
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade PostgreSQL to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

An attacker needs to be a database user with privileges sufficient to submit oversized tuple data. The attack can be carried out remotely and does not require user interaction.

What is the impact if exploitation succeeds?

Successful exploitation can allow arbitrary code execution as the operating system user that runs the PostgreSQL database process. This can compromise the confidentiality, integrity, and availability of data accessible to that operating system account.

Which PostgreSQL versions need to be updated?

Affected releases are versions earlier than PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed Alpine packages are postgresql15, postgresql16, postgresql17, and postgresql18.

ALPINE-CVE-2026-120139: High severity alpine/postgresql15 vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which PostgreSQL versions need to be updated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the impact if exploitation succeeds?

Which PostgreSQL versions need to be updated?