{"id":"CVE-2026-116309","kind":"vulnerability","aliases":["CVE-2026-116309"],"related":[],"title":"PostgreSQL: plperl type confusion may let an object creator run code","description":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY.  We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"A type confusion flaw in PostgreSQL's plperl extension lets a user who creates Perl objects blessing a non-hash reference into PostgreSQL::InServer::ARRAY potentially execute arbitrary code. The maintainers have not confirmed that the pointer can be controlled enough to reach that impact, but they are treating it as possible.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PostgreSQL","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["database","postgresql","runtime","self-hosted"],"not_affected_if":["patched-version","plperl-not-installed"],"how_to_check":"- Check the server version with `postgres --version` or `SELECT version();`; versions before `18.7`, `17.12`, `16.16`, `15.20` and `14.25` are affected.\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';` (or `plperlu`).","fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20` and `14.25` or later.","status":"open","published_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","triaged_at":"2026-11-12T15:43:38+00:00","updated_at":"2026-11-12T15:43:38+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-12T15:43:38Z","model":"claude-haiku-5-5","output":{"fix":"- PostgreSQL `18.7`, `17.12`, `16.16`, `15.20` and `14.25` or later.","reach":"local","title":"PostgreSQL: plperl type confusion may let an object creator run code","impact":"high","summary":"A type confusion flaw in PostgreSQL's plperl extension lets a user who creates Perl objects blessing a non-hash reference into PostgreSQL::InServer::ARRAY potentially execute arbitrary code. The maintainers have not confirmed that the pointer can be controlled enough to reach that impact, but they are treating it as possible.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","self-hosted","database"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"database user runs arbitrary code on the database server","analyst_note":"Confirm the plperl default and whether trusted (plperl) vs untrusted (plperlu) matters; check the PostgreSQL security advisory for exact fix details.","how_to_check":"- Check the server version with `postgres --version` or `SELECT version();`; versions before `18.7`, `17.12`, `16.16`, `15.20` and `14.25` are affected.\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';` (or `plperlu`).","plain_action":"","product_name":"PostgreSQL","needs_analyst":true,"not_affected_if":["plperl-not-installed","patched-version"],"who_is_affected":"Only servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 with the plperl procedural language loaded are exposed. The flaw needs a database user who can run Perl code in the database to create objects, so servers without plperl or with only trusted, locked-down users are lower risk. unknown for whether default installs ship plperl enabled.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4611,"output_tokens":716,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116309':14A,17A '-2026':13A,16A '14.25':138C '15.20':136C '16.16':135C '17.12':134C '18.7':133C 'achiev':118C 'affect':140C 'allow':84C 'arbitrari':53B,90C 'array':50B,102C 'bless':41B,93C 'code':11A,54B,91C 'confirm':59B,106C 'confus':4A,27B,79C 'control':65B,113C 'creat':38B 'creator':9A,87C 'cve':12A,15A 'databas':19B 'enough':66B 'execut':52B,89C 'extens':33B 'flaw':28B 'hash':45B,97C 'host':24B 'impact':70B,120C 'inserv':49B,101C 'let':6A,34B 'maintain':56B 'may':5A,83C 'non':44B,96C 'non-hash':43B,95C 'object':8A,40B,86C 'perl':39B 'plperl':2A,32B,82C 'pointer':62B,115C 'possibl':77B,129C 'postgresql':1A,18A,20B,30B,48B,81C,100C,132C 'potenti':51B 'proceed':124C 'reach':68B 'refer':46B,98C 'rule':108C 'run':10A 'runtim':21B 'secur':119C 'self':23B 'self-host':22B 'suffici':116C 'though':126C 'treat':74B 'type':3A,26B,78C 'user':36B 'version':130C 'via':92C 'way':111C","nicknames":[],"mitigations":[],"who_affected":"Only servers running PostgreSQL before 18.7, 17.12, 16.16, 15.20 or 14.25 with the plperl procedural language loaded are exposed. The flaw needs a database user who can run Perl code in the database to create objects, so servers without plperl or with only trusted, locked-down users are lower risk. unknown for whether default installs ship plperl enabled.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["postgresql"],"ptokens":["postgresql"],"labels":["database","high","postgresql","runtime","selfhosted","vendor"],"campaign_type":null,"search_a":"'-116309':14A,17A '-2026':13A,16A 'code':11A 'confus':4A 'creator':9A 'cve':12A,15A 'let':6A 'may':5A 'object':8A 'plperl':2A 'postgresql':1A,18A 'run':10A 'type':3A","search_b":"'arbitrari':53B 'array':50B 'bless':41B 'code':54B 'confirm':59B 'confus':27B 'control':65B 'creat':38B 'databas':19B 'enough':66B 'execut':52B 'extens':33B 'flaw':28B 'hash':45B 'host':24B 'impact':70B 'inserv':49B 'let':34B 'maintain':56B 'non':44B 'non-hash':43B 'object':40B 'perl':39B 'plperl':32B 'pointer':62B 'possibl':77B 'postgresql':20B,30B,48B 'potenti':51B 'reach':68B 'refer':46B 'runtim':21B 'self':23B 'self-host':22B 'treat':74B 'type':26B 'user':36B","search_c":"'14.25':138C '15.20':136C '16.16':135C '17.12':134C '18.7':133C 'achiev':118C 'affect':140C 'allow':84C 'arbitrari':90C 'array':102C 'bless':93C 'code':91C 'confirm':106C 'confus':79C 'control':113C 'creator':87C 'execut':89C 'hash':97C 'impact':120C 'inserv':101C 'may':83C 'non':96C 'non-hash':95C 'object':86C 'plperl':82C 'pointer':115C 'possibl':129C 'postgresql':81C,100C,132C 'proceed':124C 'refer':98C 'rule':108C 'secur':119C 'suffici':116C 'though':126C 'type':78C 'version':130C 'via':92C 'way':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116309","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116309","severity":null,"published_at":"2026-11-12T15:17:38+00:00","modified_at":"2026-11-12T15:17:38+00:00","first_seen_at":"2026-11-12T15:41:53+00:00","fetched_at":"2026-11-12T15:41:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}