{"id":"CVE-2026-116319","kind":"vulnerability","aliases":["CVE-2026-116319"],"related":[],"title":"PostgreSQL: plperl use-after-free lets an object creator run OS code","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.","summary":"PostgreSQL's plperl extension has a use-after-free bug triggered by reentrant return_next() calls. A user who can create database objects can execute arbitrary code as the operating system user running the database.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database","plperl","postgresql","runtime","self-hosted"],"not_affected_if":["plperl-not-installed","trusted-users-only"],"how_to_check":"- Check the running server version with `postgres --version` or `SELECT version();`\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';`","fix":"- Move to PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` (per the affected ranges given: versions before these are affected)","status":"open","published_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","triaged_at":"2026-11-12T15:43:30+00:00","updated_at":"2026-11-12T15:43:30+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-12T15:43:30Z","model":"claude-haiku-5-5","output":{"fix":"- Move to PostgreSQL `18.7`, `17.12`, `16.16`, `15.20`, or `14.25` (per the affected ranges given: versions before these are affected)","reach":"network","title":"PostgreSQL: plperl use-after-free lets an object creator run OS code","impact":"high","summary":"PostgreSQL's plperl extension has a use-after-free bug triggered by reentrant return_next() calls. A user who can create database objects can execute arbitrary code as the operating system user running the database.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["postgresql","plperl","self-hosted","database"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"code runs as the database operating system user","analyst_note":"Product ranges are listed as PostgreSQL versions; confirm the vendor advisory for exact details if needed.\n","how_to_check":"- Check the running server version with `postgres --version` or `SELECT version();`\n- Check whether the plperl extension is installed with `SELECT * FROM pg_extension WHERE extname = 'plperl';`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plperl-not-installed","trusted-users-only"],"who_is_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected, and the risk is highest where plperl is installed and untrusted users can create database objects. Systems without the plperl extension, or where only trusted administrators create objects, are less exposed. The sources do not say whether the fix is available for every branch beyond those listed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000758,"input_tokens":4546,"output_tokens":606,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116319':16A,19A '-2026':15A,18A '14.25':98C '15.20':96C '16.16':95C '17.12':94C '18.7':93C 'affect':100C 'allow':69C 'arbitrari':53B,75C 'bug':37B 'call':43B,89C 'code':13A,54B,76C 'creat':48B 'creator':10A,72C 'cve':14A,17A 'databas':20B,49B,62B,84C 'execut':52B,74C 'extens':30B 'free':6A,36B,65C 'host':26B 'let':7A 'next':42B,88C 'object':9A,50B,71C 'oper':57B,79C 'os':12A 'plperl':2A,21B,29B,68C 'postgresql':1A,22B,27B,67C,92C 'reentrant':40B,86C 'return':41B,87C 'run':11A,60B,82C 'runtim':23B 'self':25B 'self-host':24B 'system':58B,80C 'trigger':38B 'use':4A,34B,63C 'use-after-fre':3A,33B 'user':45B,59B,81C 'version':90C 'via':85C","nicknames":[],"mitigations":[],"who_affected":"Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected, and the risk is highest where plperl is installed and untrusted users can create database objects. Systems without the plperl extension, or where only trusted administrators create objects, are less exposed. The sources do not say whether the fix is available for every branch beyond those listed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["database","high","plperl","postgresql","runtime","selfhosted"],"campaign_type":null,"search_a":"'-116319':16A,19A '-2026':15A,18A 'code':13A 'creator':10A 'cve':14A,17A 'free':6A 'let':7A 'object':9A 'os':12A 'plperl':2A 'postgresql':1A 'run':11A 'use':4A 'use-after-fre':3A","search_b":"'arbitrari':53B 'bug':37B 'call':43B 'code':54B 'creat':48B 'databas':20B,49B,62B 'execut':52B 'extens':30B 'free':36B 'host':26B 'next':42B 'object':50B 'oper':57B 'plperl':21B,29B 'postgresql':22B,27B 'reentrant':40B 'return':41B 'run':60B 'runtim':23B 'self':25B 'self-host':24B 'system':58B 'trigger':38B 'use':34B 'use-after-fre':33B 'user':45B,59B","search_c":"'14.25':98C '15.20':96C '16.16':95C '17.12':94C '18.7':93C 'affect':100C 'allow':69C 'arbitrari':75C 'call':89C 'code':76C 'creator':72C 'databas':84C 'execut':74C 'free':65C 'next':88C 'object':71C 'oper':79C 'plperl':68C 'postgresql':67C,92C 'reentrant':86C 'return':87C 'run':82C 'system':80C 'use':63C 'user':81C 'version':90C 'via':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T15:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116319","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116319","severity":null,"published_at":"2026-11-12T15:17:40+00:00","modified_at":"2026-11-12T15:17:40+00:00","first_seen_at":"2026-11-12T15:41:54+00:00","fetched_at":"2026-11-12T15:41:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}