AZL-113699: CVE-2026-116312 affecting package postgresql 16.15-1
Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16
Event History
Frequently Asked Questions
Which deployments are affected?
PostgreSQL major versions 15 through 18 are affected when running versions before 15.20, 16.16, 17.12, or 18.7. Versions before PostgreSQL 15 are unaffected.
What conditions are needed to trigger the issue?
The issue requires a MERGE against a partitioned table that performs an INSERT before an UPDATE. It involves an AFTER trigger processing the wrong new row due to inconsistent transition-capture state.
How can I determine whether my Azure Linux package is affected?
The listed affected package is azure-linux/postgresql 16.15-1. For PostgreSQL 16, versions before 16.16 are affected.