Skip to content
OpenAdvisories

Package · Alpine

postgresql17

54 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.2
    CVE-2026-6471 Public exploit

    PostgreSQL logical decoding can dlopen arbitrary file

    Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary cod…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-14669 Public exploit

    PostgreSQL to_char heap buffer overflow executes arbitrary code

    Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11, 16.15, …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-14662 Public exploit

    PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

    Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating s…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-6475 Public exploit

    PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice

    Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after t…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.8
    CVE-2026-2005 Public exploit

    PostgreSQL pgcrypto heap buffer overflow executes arbitrary code

    Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.8
    CVE-2025-8714 Public exploit

    PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client

    Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands. pg_dumpall…

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine
  • High 8.1
    CVE-2025-1094 Public exploit EPSS 90%

    PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation

    Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL …

    postgresql-9.3 postgresql15 postgresql-9.5 postgresql-10 Debian Ubuntu Alpine