Detections
Analytics
Alpine: multiple postgresql17 packages: security update to 17.8-r0
high Tenable Cloud Security Plugin ID 437737
Description
There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:- Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of
server memory. We have not ruled out viability of attacks that arrange for presence of confidential
information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12,
15.16, and 14.21 are affected. (CVE-2026-2003)
- Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows
an object creator to execute arbitrary code as the operating system user running the database. Versions
before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)
- Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the
operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
are affected. (CVE-2026-2005)
- Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to
issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the
operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
are affected. (CVE-2026-2006)
- Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted
input string. The attacker has limited control over the byte patterns to be written, but we have not ruled
out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
(CVE-2026-2007)
See Also
https://security.alpinelinux.org/vuln/CVE-2026-2003
https://security.alpinelinux.org/vuln/CVE-2026-2004
https://security.alpinelinux.org/vuln/CVE-2026-2005
Plugin Details
Severity: High
ID: 437737
Version: Revision 1.11
Type: Local
Published: 2/16/2026
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7.6
Percentile: 98.46
CVSS v2
Risk Factor: High
Base Score: 9
Temporal Score: 7
Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2026-2006
CVSS v3
Risk Factor: High
Base Score: 8.8
Temporal Score: 7.9
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Vulnerability Publication Date: 2/12/2026
Reference Information
CVE: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-2007