AZL-113702: CVE-2026-116314 affecting package postgresql 16.15-1
Improper input validation in PostgreSQL pgrestore allows a non-plain archive provider to execute arbitrary code as the operating system user running pgrestore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pgrestore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 18.7 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 17.12 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 16.16 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 15.20 - Upgrade
Upgrade
postgresqlto a version that resolves this vulnerability.Fixed in 14.25
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to supply a crafted non-plain PostgreSQL archive that is processed by pg_restore. Successful exploitation can execute arbitrary code as the operating system user running pg_restore.
Are restores from all archive types affected?
The issue is described as affecting non-plain archive providers. The provided information does not indicate that plain-text SQL restore input triggers the pg_restore operating-system code execution issue.
Which PostgreSQL releases contain the fix?
The issue affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The listed package version, postgresql 16.15-1, is below the fixed 16.16 release.