ALPINE-CVE-2026-120142: High severity alpine/postgresql15 vulnerability
Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 17.12
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL 17 releases before 17.12 and PostgreSQL 18 releases before 18.7 are affected. PostgreSQL versions before 17 are unaffected.
What access does an attacker need to exploit this issue?
The attacker must be able to create the relevant database object. Exploitation does not require user interaction and can be performed over the network with low attack complexity.
What is the impact of successful exploitation?
A successful attacker can execute arbitrary code as the operating system user that runs the PostgreSQL database. This can compromise confidentiality, integrity, and availability.