CVE-2026-116320 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's plperl extension has a use-after-free bug when it converts Perl arrays or hashes, triggered by dropping the last reference to such an object. An attacker who can create such objects can execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Servers running PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, or 14.25 are affected. The flaw is in plperl, so the risk is mainly for deployments that use the plperl language; the sources do not say whether it is exploitable without it. The attacker must be able to create Perl objects inside the database, so a restricted role with no create rights is less exposed.
Not affected if managed-hosting, patched-version, plperl-not-installed
Who cares database, plperl, postgresql, self-hosted
postgres --version or SELECT version();, and compare it with the fixed releases below.SELECT * FROM pg_extension WHERE extname = 'plperl';.18.717.1216.16Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
15.2014.25