This page tracks the Alpine Linux fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-14677 →
ALPINE-CVE-2026-14677
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write o...
Original description
The description as published by the source.
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Alpine:v3.21
postgresql16
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]
Alpine:v3.22
postgresql16
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.15-r0"}]}]
Alpine:v3.21
postgresql17
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]
Alpine:v3.22
postgresql17
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]
Alpine:v3.23
postgresql17
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]
Alpine:v3.24
postgresql17
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.11-r0"}]}]
Alpine:v3.23
postgresql18
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.5-r0"}]}]
Alpine:v3.24
postgresql18
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.5-r0"}]}]
References
- advisory security.alpinelinux.org