Detections
Analytics

Alpine: postgresql15: security update to 15.16-r0

high Tenable Self-Hosted Container Security Plugin ID 437740

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of
 server memory. We have not ruled out viability of attacks that arrange for presence of confidential
 information in disclosed bytes, but they seem unlikely. Versions before PostgreSQL 18.2, 17.8, 16.12,
 15.16, and 14.21 are affected. (CVE-2026-2003)

 - Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows
 an object creator to execute arbitrary code as the operating system user running the database. Versions
 before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected. (CVE-2026-2004)

 - Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the
 operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
 are affected. (CVE-2026-2005)

 - Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to
 issue crafted queries that achieve a buffer overrun. That suffices to execute arbitrary code as the
 operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21
 are affected. (CVE-2026-2006)

 - Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted
 input string. The attacker has limited control over the byte patterns to be written, but we have not ruled
 out the viability of attacks that lead to privilege escalation. PostgreSQL 18.1 and 18.0 are affected.
 (CVE-2026-2007)

See Also

https://security.alpinelinux.org/vuln/CVE-2026-2003

https://security.alpinelinux.org/vuln/CVE-2026-2004

https://security.alpinelinux.org/vuln/CVE-2026-2005

https://security.alpinelinux.org/vuln/CVE-2026-2006

https://security.alpinelinux.org/vuln/CVE-2026-2007

Plugin Details

Severity: High

ID: 437740

Version: Revision 1.11

Type: Local

Published: 2/16/2026

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.46

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-2006

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 2/12/2026

Reference Information

CVE: CVE-2026-2003, CVE-2026-2004, CVE-2026-2005, CVE-2026-2006, CVE-2026-2007