POSTGRESQL · CVE-2026-116309 · Runtime
NO FIX YET · SEE WHAT TO DO
A type confusion flaw in PostgreSQL's plperl extension lets a user who creates Perl objects blessing a non-hash reference into PostgreSQL::InServer::ARRAY potentially execute arbitrary code. The maintainers have not confirmed that the pointer can be controlled enough to reach that impact, but they are treating it as possible.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 with the plperl procedural language loaded are exposed. The flaw needs a database user who can run Perl code in the database to create objects, so servers without plperl or with only trusted, locked-down users are lower risk. unknown for whether default installs ship plperl enabled.
Not affected if patched-version, plperl-not-installed
Who cares database, postgresql, self-hosted
postgres --version or SELECT version();; versions before 18.7, 17.12, 16.16, 15.20 and 14.25 are affected.SELECT * FROM pg_extension WHERE extname = 'plperl'; (or plperlu).Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
18.7, 17.12, 16.16, 15.20 and 14.25 or later.