ALPINE-CVE-2026-120144: High severity alpine/postgresql15 vulnerability
Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 18.7
Event History
Frequently Asked Questions
Which of the listed Alpine PostgreSQL packages are affected?
Only PostgreSQL 18 minor versions earlier than 18.7 are affected. PostgreSQL 15, 16, and 17 are unaffected because versions before PostgreSQL 18 are not affected.
What level of access does an attacker need?
The attacker needs privileges to create database objects. Exploitation involves changing a composite type while its type-cache entry is being populated.
What is the impact if exploitation succeeds?
An attacker can execute arbitrary code as the operating system user running the PostgreSQL database. This can affect confidentiality, integrity, and availability.
How can I determine whether my deployment is exposed?
Check whether the server is running PostgreSQL 18 and whether its minor version is earlier than 18.7. Deployments running PostgreSQL versions before 18 are not affected.