ALPINE-CVE-2026-16240: Low severity alpine/postgresql15 vulnerability
Use of externally-controlled format string in PostgreSQL pgbasebackup allows an attacker having already compromised a server to achieve disclosure from pgbasebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/postgresql15to a version that resolves this vulnerability.Fixed in 15.20-r0 - Upgrade
Upgrade
alpine/postgresql16to a version that resolves this vulnerability.Fixed in 16.16-r0 - Upgrade
Upgrade
alpine/postgresql17to a version that resolves this vulnerability.Fixed in 17.12-r0 - Upgrade
Upgrade
alpine/postgresql18to a version that resolves this vulnerability.Fixed in 18.7-r0 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
What access must an attacker have to exploit this issue?
The attacker must already have compromised a PostgreSQL server and be able to influence backup manifest bytes processed by pg_basebackup. The attack does not require privileges or user interaction beyond that pre-existing server compromise.
Which PostgreSQL releases are affected?
Affected versions are those before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. Updating to the applicable listed release or later addresses the issue.
Can the improperly read memory be sent directly to the attacker?
No. The vulnerability does not return the improperly read bytes to the attacker's server; successful disclosure would require separate, implementation-specific secrets.