ALPINE-CVE-2026-120149: Buffer Overflow

Q: Which deployments are exposed to this issue?

Deployments using postgres_fdw for foreign batch inserts are exposed when the foreign server can report that it inserted more rows than the local server supplied. This can legitimately occur if a rule on the remote table expands an INSERT into additional rows.

Q: What access does an attacker need to exploit it?

The vulnerability has network attack vector, low attack complexity, no user interaction requirement, and requires low privileges. The foreign server must be able to provide the oversized inserted-row report during a foreign batch insert.

Q: Which PostgreSQL releases contain the fix?

The issue affects releases before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the applicable listed release or later.

Published Nov 12, 2026

Updated

Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgresfdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

Affected Software

12 affected componentsFixes available

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql15<15.20-r0

15.20-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql16<16.16-r0

16.16-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql17<17.12-r0

17.12-r0

alpine/postgresql18<18.7-r0

18.7-r0

alpine/postgresql18<18.7-r0

18.7-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade alpine/postgresql15 to a version that resolves this vulnerability.
Fixed in 15.20-r0
Upgrade
Upgrade alpine/postgresql16 to a version that resolves this vulnerability.
Fixed in 16.16-r0
Upgrade
Upgrade alpine/postgresql17 to a version that resolves this vulnerability.
Fixed in 17.12-r0
Upgrade
Upgrade alpine/postgresql18 to a version that resolves this vulnerability.
Fixed in 18.7-r0
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.20
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 14.25

Event History

Nov 12, 2026

CVE Published

via OSV·03:17 PM

Data Sourced

via OSV·03:17 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using postgres_fdw for foreign batch inserts are exposed when the foreign server can report that it inserted more rows than the local server supplied. This can legitimately occur if a rule on the remote table expands an INSERT into additional rows.

What access does an attacker need to exploit it?

The vulnerability has network attack vector, low attack complexity, no user interaction requirement, and requires low privileges. The foreign server must be able to provide the oversized inserted-row report during a foreign batch insert.

Which PostgreSQL releases contain the fix?

The issue affects releases before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Upgrade to the applicable listed release or later.

ALPINE-CVE-2026-120149: Buffer Overflow

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What access does an attacker need to exploit it?

Which PostgreSQL releases contain the fix?

Company

Resources

Contact