AZL-113780: CVE-2026-120152 affecting package postgresql 16.15-1
Use after free in PostgreSQL pgshowallsettings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 18.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.12 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.16
Event History
Frequently Asked Questions
Which PostgreSQL deployments are affected?
PostgreSQL major versions 16 through 18 are affected when running versions earlier than 16.16, 17.12, or 18.7, respectively. PostgreSQL versions before 16 are unaffected.
What access does an attacker need to exploit this issue?
The issue requires a database user who can load a module while pg_show_all_settings() scans custom-variable placeholders. The disclosed impact is retrieval of memory contents.
Which versions contain the fix?
The fix is present in PostgreSQL 16.16, 17.12, and 18.7 and later releases within those major-version lines.