ALPINE-CVE-2026-120152: Use After Free
Use after free in PostgreSQL pgshowallsettings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL 16, 17, and 18 are affected when running versions earlier than 16.16, 17.12, or 18.7, respectively. PostgreSQL versions before 16 are unaffected; this includes the listed alpine/postgresql15 package.
What access does an attacker need?
An attacker must already be a database user with privileges sufficient to load a module. Exploitation occurs while pg_show_all_settings() scans custom-variable placeholders that a loaded module replaces and frees.
What is the impact of successful exploitation?
Successful exploitation can disclose memory contents to the database user. The provided severity vector indicates no integrity or availability impact.