{"id":"CVE-2026-116307","kind":"vulnerability","aliases":["CVE-2026-116307"],"related":[],"title":"PostgreSQL: plperl use-after-free lets a database object creator run OS code","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A use-after-free in PostgreSQL's plperl extension occurs when plperl is re-entered and a prepared query is freed while an outer call is still running it. A user who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","plperl","postgresql","runtime","self-hosted"],"not_affected_if":["patched-version","plperl-not-installed","restricted-object-creation"],"how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare with the fixed versions below.\n- Check whether the plperl extension is installed: `psql -c \"SELECT extname FROM pg_extension WHERE extname = 'plperl';\"`","fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","status":"open","published_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:43:39+00:00","updated_at":"2026-11-12T15:43:39+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:39Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`\n- PostgreSQL `17.12`\n- PostgreSQL `16.16`\n- PostgreSQL `15.20`\n- PostgreSQL `14.25`","reach":"local","title":"PostgreSQL: plperl use-after-free lets a database object creator run OS code","impact":"high","summary":"A use-after-free in PostgreSQL's plperl extension occurs when plperl is re-entered and a prepared query is freed while an outer call is still running it. A user who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","plperl","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Code runs as the database operating system user on the server.","analyst_note":"","how_to_check":"- Run `psql -c \"SHOW server_version;\"` and compare with the fixed versions below.\n- Check whether the plperl extension is installed: `psql -c \"SELECT extname FROM pg_extension WHERE extname = 'plperl';\"`\n- unknown for anything else","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plperl-not-installed","patched-version","restricted-object-creation"],"who_is_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. The flaw sits in the plperl procedural language, so systems that do not use plperl are likely not exposed. Exploitation requires the ability to create database objects, so tightly restricted databases carry less risk.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":4563,"output_tokens":636,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116307':17A,20A '-2026':16A,19A '14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'affect':127C 'allow':84C 'arbitrari':68B,90C 'call':54B 'code':14A,69B,91C 'creat':63B 'creator':11A,87C 'cve':15A,18A 'databas':9A,21B,64B,77B,99C 'enter':44B,103C 'execut':67B,89C,115C 'extens':37B 'free':6A,32B,80C,106C 'freed':50B 'host':27B 'invoc':113C 'let':7A 'object':10A,65B,86C 'occur':38B 'oper':72B,94C 'os':13A 'outer':53B,112C 'plperl':2A,22B,36B,40B,83C,104C 'postgresql':1A,23B,34B,82C,119C 'prepar':47B,108C 'queri':48B,109C 're':43B,102C 're-ent':42B,101C 'run':12A,57B,75B,97C 'runtim':24B 'self':26B 'self-host':25B 'still':56B 'system':73B,95C 'use':4A,30B,78C 'use-after-fre':3A,29B 'user':60B,74B,96C 'version':117C 'via':100C","nicknames":[],"mitigations":[],"who_affected":"Only servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20 or 14.25 are affected. The flaw sits in the plperl procedural language, so systems that do not use plperl are likely not exposed. Exploitation requires the ability to create database objects, so tightly restricted databases carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","plperl","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116307':17A,20A '-2026':16A,19A 'code':14A 'creator':11A 'cve':15A,18A 'databas':9A 'free':6A 'let':7A 'object':10A 'os':13A 'plperl':2A 'postgresql':1A 'run':12A 'use':4A 'use-after-fre':3A","search_b":"'arbitrari':68B 'call':54B 'code':69B 'creat':63B 'databas':21B,64B,77B 'enter':44B 'execut':67B 'extens':37B 'free':32B 'freed':50B 'host':27B 'object':65B 'occur':38B 'oper':72B 'outer':53B 'plperl':22B,36B,40B 'postgresql':23B,34B 'prepar':47B 'queri':48B 're':43B 're-ent':42B 'run':57B,75B 'runtim':24B 'self':26B 'self-host':25B 'still':56B 'system':73B 'use':30B 'use-after-fre':29B 'user':60B,74B","search_c":"'14.25':125C '15.20':123C '16.16':122C '17.12':121C '18.7':120C 'affect':127C 'allow':84C 'arbitrari':90C 'code':91C 'creator':87C 'databas':99C 'enter':103C 'execut':89C,115C 'free':80C,106C 'invoc':113C 'object':86C 'oper':94C 'outer':112C 'plperl':83C,104C 'postgresql':82C,119C 'prepar':108C 'queri':109C 're':102C 're-ent':101C 'run':97C 'system':95C 'use':78C 'user':96C 'version':117C 'via':100C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116307","severity":null,"published_at":"2026-11-12T15:17:38+00:00","modified_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}