HighFix available
postgresql14, postgresql15 and 1 more products — security advisory
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
- Products
- postgresql14, postgresql15, postgresql16
- Affected versions
- Not specified
- Fixed versions
- 14.10-r0, 15.5-r0, 16.1-r0
- CVEs
- CVE-2023-5869
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 15:06 UTC · Revision 1
Source evidence
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.
osv:ALPINE-CVE-2023-5869
postgresql14
Fixed versions: 14.10-r0
postgresql14
Fixed versions: 14.10-r0
postgresql14
Fixed versions: 14.10-r0
postgresql14
Fixed versions: 14.10-r0
postgresql15
Fixed versions: 15.5-r0
postgresql15
Fixed versions: 15.5-r0
postgresql15
Fixed versions: 15.5-r0
postgresql15
Fixed versions: 15.5-r0
postgresql16
Fixed versions: 16.1-r0
postgresql16
Fixed versions: 16.1-r0
postgresql16
Fixed versions: 16.1-r0
postgresql16
Fixed versions: 16.1-r0
Complete source record
{
"id": "9a41d6bf97a128d00e86fa998c87ba504b8dfc70ba355f6a423fa1685eb53c96",
"url": "https://osv.dev/vulnerability/ALPINE-CVE-2023-5869",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ALPINE-CVE-2023-5869",
"summary": "A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.",
"evidence": "osv:ALPINE-CVE-2023-5869",
"products": [
{
"name": {
"value": "postgresql14",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.10-r0",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.10-r0",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.10-r0",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql14",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "14.10-r0",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.5-r0",
"evidence": "/affected/4/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.5-r0",
"evidence": "/affected/5/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.5-r0",
"evidence": "/affected/6/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql15",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "15.5-r0",
"evidence": "/affected/7/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql16",
"evidence": "/affected/8/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "16.1-r0",
"evidence": "/affected/8/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql16",
"evidence": "/affected/9/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "16.1-r0",
"evidence": "/affected/9/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql16",
"evidence": "/affected/10/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "16.1-r0",
"evidence": "/affected/10/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "postgresql16",
"evidence": "/affected/11/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "16.1-r0",
"evidence": "/affected/11/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "ALPINE-CVE-2023-5869",
"aliases": [
"ALPINE-CVE-2023-5869"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.10-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.15"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.10-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.16"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.10-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "14.10-r0"
}
]
}
],
"package": {
"name": "postgresql14",
"purl": "pkg:apk/alpine/postgresql14?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.5-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.17"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.5-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.18"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.5-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "15.5-r0"
}
]
}
],
"package": {
"name": "postgresql15",
"purl": "pkg:apk/alpine/postgresql15?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1-r0"
}
]
}
],
"package": {
"name": "postgresql16",
"purl": "pkg:apk/alpine/postgresql16?arch=source",
"ecosystem": "Alpine:v3.19"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1-r0"
}
]
}
],
"package": {
"name": "postgresql16",
"purl": "pkg:apk/alpine/postgresql16?arch=source",
"ecosystem": "Alpine:v3.20"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1-r0"
}
]
}
],
"package": {
"name": "postgresql16",
"purl": "pkg:apk/alpine/postgresql16?arch=source",
"ecosystem": "Alpine:v3.21"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "16.1-r0"
}
]
}
],
"package": {
"name": "postgresql16",
"purl": "pkg:apk/alpine/postgresql16?arch=source",
"ecosystem": "Alpine:v3.22"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2023-5869.json"
},
"ecosystem_specific": {}
}
],
"modified": "2026-10-26T17:17:58.667369321Z",
"provider": "osv",
"upstream": [
"CVE-2023-5869"
],
"references": [
"https://security.alpinelinux.org/vuln/CVE-2023-5869"
]
},
"related_cves": [
{
"value": "CVE-2023-5869",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 454581,
"published_at": "2023-12-10T18:15:07.41+00:00"
}